Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 29, 2023, 2:21 p.m.	Nov. 29, 2023, 2:30 p.m.

Size	962.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5ab89a96be7570dfe4f49e6b9a42bc88`
SHA256	`85789e8cfddea18201a13e3c953229ed1b03db7455208a398bb2268a39258354`
CRC32	`F4AA9CCC`
ssdeep	`24576:/nsJ39LyjbJkQFMhmC+6GD9GG6VasP7bgY+yP:/nsHyjtk2MYC5GD9A77`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

123.exe "C:\Users\test22\AppData\Local\Temp\123.exe"
2656
- ._cache_123.exe "C:\Users\test22\AppData\Local\Temp\._cache_123.exe"
  2784
- Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2856

Name	Response	Post-Analysis Lookup
www.dropbox.com	CNAME www-env.dropbox-dns.com A 162.125.84.18	162.125.84.18
xred.mooo.com
docs.google.com	A 142.251.220.14	142.250.206.206
freedns.afraid.org	A 69.42.215.252	69.42.215.252

IP Address	Status	Action
142.251.220.14	Active	Moloch
162.125.84.18	Active	Moloch
164.124.101.2	Active	Moloch
45.125.57.96	Active	Moloch
69.42.215.252	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:53004 -> 164.124.101.2:53	2015633	ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com	Misc activity
TCP 192.168.56.101:49174 -> 162.125.84.18:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49172 -> 142.251.220.14:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 162.125.84.18:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 45.125.57.96:8888	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 45.125.57.96:8888 -> 192.168.56.101:49164	2045860	ET HUNTING Rejetto HTTP File Sever Response	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49172 142.251.220.14:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=*.google.com	4c:0d:17:8c:f1:30:7c:3a:6f:9b:8e:b4:83:0e:5c:bd:ed:17:3e:95

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Nov. 29, 2023, 2:22 p.m.	computer_name: TEST22-PC	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Nov. 29, 2023, 2:22 p.m.	stacktrace: synaptics+0x7bda4 @ 0x47bda4 synaptics+0x7bcf2 @ 0x47bcf2 synaptics+0x7bcb3 @ 0x47bcb3 synaptics+0x845fd @ 0x4845fd synaptics+0x959fc @ 0x4959fc BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 60095964 registers.edi: 60096152 registers.eax: 60095964 registers.ebp: 60096044 registers.edx: 0 registers.ebx: 4703484 registers.esi: 11001 registers.ecx: 7	1
__exception__ Nov. 29, 2023, 2:22 p.m.	stacktrace: synaptics+0x7bda4 @ 0x47bda4 synaptics+0x7bcf2 @ 0x47bcf2 synaptics+0x7bcb3 @ 0x47bcb3 synaptics+0x845fd @ 0x4845fd synaptics+0x95a83 @ 0x495a83 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 60093776 registers.edi: 60093964 registers.eax: 60093776 registers.ebp: 60093856 registers.edx: 0 registers.ebx: 4703484 registers.esi: 11004 registers.ecx: 7	1
__exception__ Nov. 29, 2023, 2:22 p.m.	stacktrace: synaptics+0x7bda4 @ 0x47bda4 synaptics+0x7bcf2 @ 0x47bcf2 synaptics+0x7bcb3 @ 0x47bcb3 synaptics+0x845fd @ 0x4845fd synaptics+0x95b0a @ 0x495b0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 60091588 registers.edi: 60091776 registers.eax: 60091588 registers.ebp: 60091668 registers.edx: 0 registers.ebx: 4703484 registers.esi: 11001 registers.ecx: 7	1

Connects to a Dynamic DNS Domain (1 event)

domain

xred.mooo.com

Performs some HTTP requests (3 events)

request	GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
request	GET https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request	GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 29, 2023, 2:21 p.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 29, 2023, 2:21 p.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 29, 2023, 2:22 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 3203072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 29, 2023, 2:22 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1030f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 2:22 p.m.	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02080000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 29, 2023, 2:22 p.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (11 events)

name

RT_ICON

language

LANG_TURKISH

filetype

dBase IV DBT of @.DBF, block length 8192, next free block index 40

sublanguage

SUBLANG_DEFAULT

offset

0x000b1028

size

0x000010a8

name

RT_ICON

language

LANG_TURKISH

filetype

dBase IV DBT of @.DBF, block length 8192, next free block index 40

sublanguage

SUBLANG_DEFAULT

offset

0x000b1028

size

0x000010a8

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_RCDATA

language

LANG_TURKISH

filetype

Microsoft Excel 2007+

sublanguage

SUBLANG_DEFAULT

offset

0x000f1794

size

0x000047d3

name

RT_GROUP_ICON

language

LANG_TURKISH

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x000f5f68

size

0x00000014

Downloads a file or document from Google Drive (1 event)

domain

docs.google.com

Creates executable files on the filesystem (3 events)

file	C:\Program Files\AppPatch\8.77.dll
file	C:\ProgramData\Synaptics\Synaptics.dll
file	C:\Users\test22\AppData\Local\Temp\._cache_123.exe

Looks up the Dropbox cloud service (1 event)

domain

www.dropbox.com

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\._cache_123.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\._cache_123.exe

Communicates with host for which no DNS query was performed (1 event)

host

45.125.57.96

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

reg_value

C:\ProgramData\Synaptics\Synaptics.exe

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Nov. 29, 2023, 2:22 p.m.	thread_identifier: 0 callback_function: 0x03993540 hook_identifier: 2 (WH_KEYBOARD) module_address: 0x03990000	1	852375	0

Network activity contains more than one unique useragent (3 events)

process	._cache_123.exe	useragent	Mozilla/4.0 (compatible)
process	Synaptics.exe	useragent	MyApp
process	Synaptics.exe	useragent	Synaptics.exe

File has been identified by 67 AntiVirus engines on VirusTotal as malicious (50 out of 67 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.DarkKomet.tp6k
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Dacic.AEA16DAA.A.96E7E3ED
FireEye	Generic.mg.5ab89a96be7570df
CAT-QuickHeal	Sus.Nocivo.E0011
Skyhigh	BehavesLike.Win32.Downloader.dh
ALYac	Generic.Dacic.AEA16DAA.A.96E7E3ED
Cylance	unsafe
Zillya	Trojan.Delf.Win32.76144
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 000112511 )
Alibaba	Backdoor:Win32/Zlob.180910
K7GW	Trojan ( 000112511 )
Cybereason	malicious.9e77e0
BitDefenderTheta	AI:Packer.96BD33E81D
Symantec	W32.Zorex
tehtris	Generic.Malware
ESET-NOD32	Win32/Delf.NBX
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Downloader.Zegost-6484584-1
Kaspersky	Backdoor.Win32.DarkKomet.hqxy
BitDefender	Generic.Dacic.AEA16DAA.A.96E7E3ED
NANO-Antivirus	Trojan.Win32.DarkKomet.fazbwq
Avast	Win32:Dropper-OHP [Trj]
Tencent	Virus.Win32.DarkKomet.yb
TACHYON	Backdoor/W32.DP-DarkKomet.985088.B
Emsisoft	Generic.Dacic.AEA16DAA.A.96E7E3ED (B)
Baidu	Win32.Trojan-Downloader.Agent.bh
F-Secure	Trojan:W97M/MaliciousMacro.GEN
DrWeb	Trojan.DownLoader22.9658
VIPRE	Generic.Dacic.AEA16DAA.A.96E7E3ED
TrendMicro	Virus.Win32.NAPWHICH.B
Sophos	Troj/Zegost-ID
Ikarus	Trojan-PWS.Win32.QQPass
Jiangmin	Backdoor.DarkKomet.ljd
Webroot	W32.Malware.gen
Varist	W32/Backdoor.OAZM-5661
Avira	TR/Dldr.Agent.SH
Antiy-AVL	Virus/Win32.DarkKomet.a
Kingsoft	Win32.HeurC.KVM007.a
Microsoft	Worm:Win32/AutoRun!atmn
Gridinsoft	Trojan.Win32.Gen.tr
Xcitium	Virus.Win32.Agent.DE@74b38h
Arcabit	HEUR.VBA.Trojan.d
ViRobot	Win32.Zorex.A
ZoneAlarm	Backdoor.Win32.DarkKomet.hqxy
GData	Win32.Backdoor.Agent.AXS
Google	Detected

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 events)

dead_host	192.168.56.101:49178
dead_host	192.168.56.101:49166
dead_host	45.125.57.96:2005
dead_host	192.168.56.101:49177

123.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All