Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 21, 2024, 7:14 a.m.	March 21, 2024, 7:21 a.m.

Size	450.5KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9b5a036b6c0ad4683c19fd0a5737d296`
SHA256	`d1fa49908480e6cc8369f5802ba0e0cc7ad3cd3fc55eefde91dd78a6e3556de3`
CRC32	`521015BD`
ssdeep	`6144:6f3Vu32hIXyVyA3FzB3aLzQILB5LfNBwdMFG61Iu/nE8eBD4pi:643iYyVyCVgzQIzEChqp`
PDB Path	Blinsson.pdb
Yara	Craxs_RAT - Craxs RAT PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

crypted.exe "C:\Users\test22\AppData\Local\Temp\crypted.exe"
1184
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2160

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 21, 2024, 7:14 a.m.			0	0
IsDebuggerPresent March 21, 2024, 7:14 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

Blinsson.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 21, 2024, 7:14 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 21, 2024, 7:14 a.m.	stacktrace: cs_strdup+0x670 decodeInstruction-0x969 @ 0x746364da decodeInstruction+0x6d SHA1Reset-0xe54 @ 0x74636eb0 X86_getInstruction+0x104 printSrcIdx8-0x2874 @ 0x74631495 cs_disasm_ex+0x168 cs_free-0x55d @ 0x74630571 disasm+0x68 hook_create_stub-0x8e @ 0x74604028 log_exception+0x2bd log_action-0x360 @ 0x7460355f New_ntdll_RtlDispatchException@8+0xd7 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x42 @ 0x7462480c KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143 regasm+0x8e71 @ 0x408e71 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8a 14 02 8b 45 0c 88 10 31 c0 eb 03 83 c8 ff 83 exception.symbol: MCOperand_CreateImm0+0x6e X86_getInstruction-0x52 exception.instruction: mov dl, byte ptr [edx + eax] exception.module: monitor-x86.dll exception.exception_code: 0xc0000005 exception.offset: 201535 exception.address: 0x7463133f registers.esp: 3922192 registers.edi: 0 registers.eax: 0 registers.ebp: 3922216 registers.edx: 4294967295 registers.ebx: 0 registers.esi: 4294967295 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 21, 2024, 7:14 a.m.

stacktrace:

cs_strdup+0x670 decodeInstruction-0x969 @ 0x746364da
decodeInstruction+0x6d SHA1Reset-0xe54 @ 0x74636eb0
X86_getInstruction+0x104 printSrcIdx8-0x2874 @ 0x74631495
cs_disasm_ex+0x168 cs_free-0x55d @ 0x74630571
disasm+0x68 hook_create_stub-0x8e @ 0x74604028
log_exception+0x2bd log_action-0x360 @ 0x7460355f
New_ntdll_RtlDispatchException@8+0xd7 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x42 @ 0x7462480c
KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x778b0143
regasm+0x8e71 @ 0x408e71
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8a 14 02 8b 45 0c 88 10 31 c0 eb 03 83 c8 ff 83
exception.symbol: MCOperand_CreateImm0+0x6e X86_getInstruction-0x52
exception.instruction: mov dl, byte ptr [edx + eax]
exception.module: monitor-x86.dll
exception.exception_code: 0xc0000005
exception.offset: 201535
exception.address: 0x7463133f
registers.esp: 3922192
registers.edi: 0
registers.eax: 0
registers.ebp: 3922216
registers.edx: 4294967295
registers.ebx: 0
registers.esi: 4294967295
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00917000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00915000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0071d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a9000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00070000', u'virtual_address': u'0x00002000', u'entropy': 7.520526965789163, u'name': u'.text', u'virtual_size': u'0x0006fe54'}

entropy

7.52052696579

description

A section with a high entropy has been found

entropy

0.995555555556

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 2160 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001fc	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¦ðeàfP@°@ç¥x`ðIð¦.textÜdf `.rdatak)*j@@.data°¢°@À.relocðI`J&@B base_address: 0x00400000 process_identifier: 2160 process_handle: 0x000001fc	1	1	0
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2160 process_handle: 0x000001fc	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¦ðeàfP@°@ç¥x`ðIð¦.textÜdf `.rdatak)*j@@.data°¢°@À.relocðI`J&@B base_address: 0x00400000 process_identifier: 2160 process_handle: 0x000001fc	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1184 called NtSetContextThread to modify thread in remote process 2160
NtSetContextThread March 21, 2024, 7:14 a.m.	registers.eip: 2005598660 registers.esp: 3931124 registers.edi: 0 registers.eax: 4230736 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 2160	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1184 resumed a thread in remote process 2160
NtResumeThread March 21, 2024, 7:14 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2160	1	0	0

Executed a process and injected code into it, probably while unpacking (14 events)

Time & API	Arguments	Status	Return
NtResumeThread March 21, 2024, 7:14 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1184	1	0
NtResumeThread March 21, 2024, 7:14 a.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 1184	1	0
NtResumeThread March 21, 2024, 7:14 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 1184	1	0
CreateProcessInternalW March 21, 2024, 7:14 a.m.	thread_identifier: 2164 thread_handle: 0x000001f8 process_identifier: 2160 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001fc	1	1
NtGetContextThread March 21, 2024, 7:14 a.m.	thread_handle: 0x000001f8	1	0
NtAllocateVirtualMemory March 21, 2024, 7:14 a.m.	process_identifier: 2160 region_size: 307200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001fc	1	0
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¦ðeàfP@°@ç¥x`ðIð¦.textÜdf `.rdatak)*j@@.data°¢°@À.relocðI`J&@B base_address: 0x00400000 process_identifier: 2160 process_handle: 0x000001fc	1	1
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: base_address: 0x00401000 process_identifier: 2160 process_handle: 0x000001fc	1	1
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: base_address: 0x00438000 process_identifier: 2160 process_handle: 0x000001fc	1	1
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: base_address: 0x0043b000 process_identifier: 2160 process_handle: 0x000001fc	1	1
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: base_address: 0x00446000 process_identifier: 2160 process_handle: 0x000001fc	1	1
WriteProcessMemory March 21, 2024, 7:14 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2160 process_handle: 0x000001fc	1	1
NtSetContextThread March 21, 2024, 7:14 a.m.	registers.eip: 2005598660 registers.esp: 3931124 registers.edi: 0 registers.eax: 4230736 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 2160	1	0
NtResumeThread March 21, 2024, 7:14 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2160	1	0

crypted.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All