Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 22, 2024, 12:32 p.m.	Jan. 22, 2024, 12:35 p.m.

Size	1.6MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`1c38258e33ab23bead674c34db28e23d`
SHA256	`304a4f68bfff226a2049f6c5b38f915487ac75f5b6b62e74d17114bb05669c49`
CRC32	`FCA8E5A0`
ssdeep	`24576:9JwFeU3G7kH++1w7qWgjnIU69VdO/PWTA0/ElSXryaYl1E0XJx:iG7kH++nWWno9qI5/EZaE1b`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) hide_executable_file - Hide executable file

Aixnslkoum.exe "C:\Users\test22\AppData\Local\Temp\Aixnslkoum.exe"
792

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 22, 2024, 12:25 p.m.			0	0
IsDebuggerPresent Jan. 22, 2024, 12:25 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 22, 2024, 12:25 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c5b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93efc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 22, 2024, 12:25 p.m.	process_identifier: 792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00142800', u'virtual_address': u'0x00002000', u'entropy': 7.826296264386054, u'name': u'.text', u'virtual_size': u'0x00142760'}

entropy

7.82629626439

description

A section with a high entropy has been found

entropy

0.811831340466

description

Overall entropy of this PE file is high

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W64.AIDetectMalware.CS
Lionic	Trojan.Win32.AgentTesla.a!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.71270227
Cylance	unsafe
VIPRE	Trojan.GenericKD.71270227
Sangfor	Downloader.Msil.AgentTesla.Vgak
K7AntiVirus	Trojan ( 005b0bcd1 )
BitDefender	Trojan.GenericKD.71270227
K7GW	Trojan ( 005b0bcd1 )
Arcabit	Trojan.Generic.D43F7F53
VirIT	Trojan.Win64.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AKQX
APEX	Malicious
McAfee	Artemis!1C38258E33AB
Avast	Win64:RATX-gen [Trj]
ClamAV	Win.Trojan.EmbeddedDotNetBinary-9940868-0
Kaspersky	HEUR:Trojan-Downloader.MSIL.Seraph.gen
Alibaba	TrojanDownloader:MSIL/AgentTesla.a207fb12
MicroWorld-eScan	Trojan.GenericKD.71270227
Rising	Malware.Obfus/MSIL@AI.80 (RDM.MSIL2:vJcGC1Ml720LV8SDbV0+0w)
Emsisoft	Trojan.GenericKD.71270227 (B)
F-Secure	Trojan.TR/Tesla.ocnbv
DrWeb	Trojan.Inject4.30867
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Trojan.Gen
Avira	TR/Tesla.ocnbv
Kingsoft	MSIL.Trojan-Downloader.Seraph.gen
Gridinsoft	Trojan.Win64.Downloader.cl
Microsoft	Trojan:MSIL/AgentTesla.PTGS!MTB
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.Seraph.gen
GData	Trojan.GenericKD.71270227
Varist	W64/ABRisk.BJNE-8618
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
Tencent	Msil.Trojan-Downloader.Seraph.Ychl
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/Agent.QES!tr.dldr
AVG	Win64:RATX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

Aixnslkoum.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All