Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 25, 2024, 8:51 a.m.	Jan. 25, 2024, 8:55 a.m.

Size	411.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`239d67b4a07dcc1ea81b612e93bc97ff`
SHA256	`e82b624894f19ede8cbc367be3f5c0257e04fff01691bcba7b48eda4b1210b6d`
CRC32	`75D7A611`
ssdeep	`6144:oDE1hv5paKXVvL7y8jgb3QGGdqQU/+1rSxzEBMCMSSRLRuvyL7z59Q3BdikGLYLS:5hjK8cztQ8/krSF6CLEvynzwR/GLYLS`
PDB Path	StreamList.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description)

swizzy.exe "C:\Users\test22\AppData\Local\Temp\swizzy.exe"
2540

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.94.230.135	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 25, 2024, 8:51 a.m.			0	0
IsDebuggerPresent Jan. 25, 2024, 8:51 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

StreamList.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 25, 2024, 8:51 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00305000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 25, 2024, 8:51 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00063c00', u'virtual_address': u'0x00002000', u'entropy': 7.883928492752692, u'name': u'.text', u'virtual_size': u'0x00063be4'}

entropy

7.88392849275

description

A section with a high entropy has been found

entropy

0.995012468828

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

185.94.230.135

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.RiseProStealer.l!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	Artemis!Trojan
McAfee	Artemis!239D67B4A07D
Cylance	unsafe
VIPRE	Gen:Variant.Zusy.534503
Sangfor	Infostealer.Msil.Riseprostealer.Vw03
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Gen:Variant.Zusy.534503
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.fcf1a3
Arcabit	Trojan.Zusy.D827E7
VirIT	Trojan.Win32.GenusT.DUQP
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AKRS
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba	TrojanSpy:MSIL/RiseProStealer.09a62beb
MicroWorld-eScan	Gen:Variant.Zusy.534503
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:KwbAwlqaOdn6GFlI10mO/w)
Emsisoft	Gen:Variant.Zusy.534503 (B)
F-Secure	Trojan.TR/AD.RedLineSteal.bokff
TrendMicro	TrojanSpy.Win32.REDLINE.YXEAWZ
FireEye	Generic.mg.239d67b4a07dcc1e
Sophos	Troj/Krypt-ADG
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/AD.RedLineSteal.bokff
MAX	malware (ai score=85)
Kingsoft	MSIL.Trojan-Spy.Stealer.gen
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	Trojan:MSIL/RiseProStealer.BQAA!MTB
ViRobot	Trojan.Win.Z.Agent.421344
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Gen:Variant.Zusy.534503
Varist	W32/MSIL_Agent.HHZ.gen!Eldorado
AhnLab-V3	Trojan/Win.RiseProStealer.C5578339
BitDefenderTheta	Gen:NN.ZemsilF.36680.zm2@aqg5fzj
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEAWZ
Tencent	Malware.Win32.Gencirc.13fe703d
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/Kryptik.AKRS!tr
AVG	Win32:PWSX-gen [Trj]

swizzy.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All