popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PsExec.exe

.NET framework(MSIL) Malicious Library UPX PE32 PE File DLL MZP Format .NET EXE JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 27, 2023, 9:23 a.m. Nov. 27, 2023, 9:32 a.m.
Size 4.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9f26f723df0ce1ad3e928f983dffc61e
SHA256 7bf634e0d7a0b311e08ad0d0d453628f4fd559bcdd4bf9f05744571bc0e0f885
CRC32 331A5638
ssdeep 49152:ynsHyjtk2MYC5GDyQBh/VoRYskNIXyjgYLriNw5mPPAy0ezYu6KD63AvHZ8ko:ynsmtk2aUhXMy81/PAyTznI3Av5s
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
www.dropbox.com
CNAME www-env.dropbox-dns.com
A 162.125.84.18
162.125.84.18
xred.mooo.com
docs.google.com
A 142.251.220.46
142.250.206.206
freedns.afraid.org
A 69.42.215.252
69.42.215.252
IP Address Status Action
142.251.220.46 Active Moloch
162.125.84.18 Active Moloch
164.124.101.2 Active Moloch
69.42.215.252 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:53004 -> 164.124.101.2:53 2015633 ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com Misc activity
TCP 192.168.56.101:49170 -> 162.125.84.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 162.125.84.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 142.251.220.46:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49169
142.251.220.46:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 4c:0d:17:8c:f1:30:7c:3a:6f:9b:8e:b4:83:0e:5c:bd:ed:17:3e:95

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x959fc @ 0x4959fc
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 60227036
registers.edi: 60227224
registers.eax: 60227036
registers.ebp: 60227116
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11001
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95a83 @ 0x495a83
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 60224848
registers.edi: 60225036
registers.eax: 60224848
registers.ebp: 60224928
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11004
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95b0a @ 0x495b0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 60222660
registers.edi: 60222848
registers.eax: 60222660
registers.ebp: 60222740
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11001
registers.ecx: 7
1 0 0
domain xred.mooo.com
request GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
request GET https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00840000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x735e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2764
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71fe1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2764
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71fe2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2824
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02050000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x735f2000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39f8 size 0x000010a8
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39f8 size 0x000010a8
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x003ff2a0 size 0x000047d3
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x00403b00 size 0x00000014
name RT_VERSION language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x00403b14 size 0x00000304
domain docs.google.com
file C:\ProgramData\Synaptics\Synaptics.dll
file C:\Users\test22\AppData\Local\Temp\._cache_PsExec.exe
domain www.dropbox.com
file C:\Users\test22\AppData\Local\Temp\._cache_PsExec.exe
file C:\Users\test22\AppData\Local\Temp\._cache_PsExec.exe
section {u'size_of_data': u'0x00354000', u'virtual_address': u'0x000b0000', u'entropy': 7.3601620855386285, u'name': u'.rsrc', u'virtual_size': u'0x00353e18'} entropy 7.36016208554 description A section with a high entropy has been found
entropy 0.833455612619 description Overall entropy of this PE file is high
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver reg_value C:\ProgramData\Synaptics\Synaptics.exe
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x039a3540
hook_identifier: 2 (WH_KEYBOARD)
module_address: 0x039a0000
1 459143 0
process Synaptics.exe useragent MyApp
process Synaptics.exe useragent Synaptics.exe
cmdline C:\Users\test22\AppData\Local\Temp\._cache_PsExec.exe
cmdline "C:\Users\test22\AppData\Local\Temp\._cache_PsExec.exe"
Bkav W32.AIDetectMalware
MicroWorld-eScan Generic.Dacic.AEA16DAA.A.A35C80DE
CAT-QuickHeal W32.Delf.NB4
Skyhigh BehavesLike.Win32.Obfuscated.wc
McAfee GenericRXSE-WD!9F26F723DF0C
Cylance unsafe
Zillya Trojan.Delf.Win32.76144
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 000112511 )
K7GW Trojan ( 000112511 )
Cybereason malicious.d10f80
VirIT Trojan.Win32.Dnldr22.OHM
Symantec W32.Zorex
Elastic malicious (high confidence)
ESET-NOD32 Win32/Delf.NBX
Cynet Malicious (score: 100)
APEX Malicious
ClamAV Win.Trojan.Emotet-9850453-0
Kaspersky Backdoor.Win32.DarkKomet.hqxy
BitDefender Generic.Dacic.AEA16DAA.A.A35C80DE
NANO-Antivirus Trojan.Win32.DarkKomet.fazbwq
Avast Win32:Zorex-E [Wrm]
Tencent Virus.Win32.DarkKomet.yb
Emsisoft Generic.Dacic.AEA16DAA.A.A35C80DE (B)
F-Secure Malware.W2000M/Dldr.Agent.17651006
DrWeb Trojan.DownLoader22.9658
VIPRE Generic.Dacic.AEA16DAA.A.A35C80DE
TrendMicro Virus.Win32.NAPWHICH.B
FireEye Generic.mg.9f26f723df0ce1ad
Sophos ElReceptor Keyboard Hook (PUA)
SentinelOne Static AI - Malicious PE
Jiangmin Win32/Synaptics.Gen
Webroot W32.Malware.gen
Varist W32/Backdoor.OAZM-5661
Avira TR/Dldr.Agent.SH
MAX malware (ai score=87)
Antiy-AVL Virus/Win32.DarkKomet.a
Kingsoft Win32.Infected.AutoInfector.a
Microsoft Worm:Win32/AutoRun!atmn
Gridinsoft Malware.Win32.Gen.sm!s1
Xcitium Virus.Win32.Agent.DE@74b38h
Arcabit HEUR.VBA.Trojan.d
ViRobot Win32.Zorex.A
ZoneAlarm Backdoor.Win32.DarkKomet.hqxy
GData Win32.Backdoor.Agent.AXS
Google Detected
AhnLab-V3 Win32/Zorex.X1799
Acronis suspicious
VBA32 TScope.Trojan.Delf
ALYac Generic.Dacic.AEA16DAA.A.A35C80DE