popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

toolspub2.exe

Malicious Library UPX AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 26, 2023, 1:31 p.m. Nov. 26, 2023, 1:46 p.m.
Size 287.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5f4839a45c6193363a21b784bf91e783
SHA256 bc79579f8c8200d068a675a1e57222550943e06dce145af11e7daf666d19346c
CRC32 BE1A5BB1
ssdeep 3072:dtoXESmqt/BYYoHu55nSu1FrLvsLZSIyJ0Xb7IXZJ9mQ5mgVmQWmZ5kVyBk3eFxQ:L+Ebqb95FrjsL9yJQbsXZDGMiml+
PDB Path C:\fazewexalozu.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path C:\fazewexalozu.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 86016
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c4c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2636
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2636
process_handle: 0x00000080
1 1 0
Process injection Process 2540 called NtSetContextThread to modify thread in remote process 2636
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2636
1 0 0
Process injection Process 2540 resumed a thread in remote process 2636
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2636
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2640
thread_handle: 0x0000007c
process_identifier: 2636
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\toolspub2.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\toolspub2.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\toolspub2.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2636
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2636
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2636
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2636
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2636
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Lockbit.dh
Sangfor Trojan.Win32.Save.a
Cybereason malicious.ad428c
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
APEX Malicious
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky VHO:Backdoor.Win32.Convagent.gen
Tencent Trojan.Win32.Obfuscated.gen
Trapmine malicious.high.ml.score
FireEye Generic.mg.5f4839a45c619336
Sophos Troj/Krypt-VK
SentinelOne Static AI - Suspicious PE
Google Detected
Kingsoft malware.kb.a.999
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm VHO:Backdoor.Win32.Convagent.gen
Cynet Malicious (score: 100)
AhnLab-V3 Downloader/Win.BeamWinHTTP.R520470
VBA32 BScope.Trojan.Yakes
Cylance unsafe
Rising Trojan.SmokeLoader!1.EF01 (CLASSIC)
Ikarus Trojan.Win32.Azorult
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.ERHN!tr
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)