Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 17, 2024, 10:44 a.m.	May 17, 2024, 10:48 a.m.

Size	17.5KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`92b5de72dcf5bf5202020e7d8d108176`
SHA256	`02d8294472a9eced7393e727f12f120dd9e0794f8867469c8a4083c7e577dea6`
CRC32	`C7514C72`
ssdeep	`192:EDMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4+gB5uDdBUbOj6kxiY:EDMAoKz6WtKEj7aBDiegbAY`
Yara	IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

artifact-64.exe "C:\Users\test22\AppData\Local\Temp\artifact-64.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
3.208.96.244	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 3.208.96.244:80 -> 192.168.56.101:49162	2035442	ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1	A Network Trojan was detected

Suricata TLS

No Suricata TLS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 17, 2024, 10:37 a.m.	stacktrace: RtlVirtualUnwind+0x11 RtlCheckForOrphanedCriticalSections-0x48f ntdll+0x19921 @ 0x76d49921 RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76c5b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x739805bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x73996d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x76d81278 RtlVirtualUnwind+0x11 RtlCheckForOrphanedCriticalSections-0x48f ntdll+0x19921 @ 0x76d49921 RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76c5b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x739805bd exception.instruction_r: 41 8b 79 08 45 33 d2 4d 8b f9 48 03 fa 4d 8b e8 exception.symbol: RtlVirtualUnwind+0x11 RtlCheckForOrphanedCriticalSections-0x48f ntdll+0x19921 exception.instruction: mov edi, dword ptr [r9 + 8] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 104737 exception.address: 0x76d49921 registers.r14: 8453952 registers.r15: 0 registers.rcx: 0 registers.rsi: 32 registers.r10: 8795063863550 registers.rbx: 63004626 registers.rsp: 8455152 registers.r11: 8446520 registers.r8: 8791601575424 registers.r9: 8795063863550 registers.rdx: 8791601250304 registers.r12: 0 registers.rbp: 0 registers.rdi: -1 registers.rax: 8448768 registers.r13: 0	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://3.208.96.244/Meeting/32251816/

Performs some HTTP requests (1 event)

request

GET http://3.208.96.244/Meeting/32251816/

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 17, 2024, 10:37 a.m.	process_identifier: 2552 region_size: 4194304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 17, 2024, 10:37 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x0000000000870000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

3.208.96.244

File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win64.Shelma.tsgG
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.CobaltStr.S17675256
Skyhigh	BehavesLike.Win64.Trojan.lm
ALYac	Gen:Variant.Bulz.405257
Cylance	unsafe
VIPRE	Gen:Variant.Bulz.405257
Sangfor	Trojan.Win32.CobaltStrike
K7AntiVirus	Trojan ( 0058fadf1 )
BitDefender	Gen:Variant.Bulz.405257
K7GW	Trojan ( 0058fadf1 )
Arcabit	Trojan.Bulz.D62F09
VirIT	Trojan.Win32.Genus.DDA
Symantec	Backdoor.Cobalt!gen1
Elastic	Windows.Trojan.CobaltStrike
ESET-NOD32	a variant of Win64/CobaltStrike.Artifact.A
APEX	Malicious
McAfee	Artemis!92B5DE72DCF5
Avast	Win64:Evo-gen [Trj]
ClamAV	Win.Trojan.CobaltStrike-9044898-1
Kaspersky	HEUR:Trojan.Win64.CobaltStrike.gen
Alibaba	Trojan:Win32/CozyDuke.1012
NANO-Antivirus	Trojan.Win64.CobaltStrike.kkfqoq
MicroWorld-eScan	Gen:Variant.Bulz.405257
Rising	Backdoor.CobaltStrike/x64!1.D04A (CLASSIC)
Emsisoft	Trojan.CobaltStrike (A)
F-Secure	Trojan.TR/CobaltStrike.muasi
DrWeb	BackDoor.CobaltStrike.86
Zillya	Tool.CobaltStrike.Win64.273
TrendMicro	Backdoor.Win64.COBEACON.SMA
FireEye	Generic.mg.92b5de72dcf5bf52
Sophos	ATK/Cobalt-CC
Ikarus	Trojan.Win64.Cobaltstrike
Jiangmin	Trojan.Generic.fsibr
Webroot	W32.Trojan.Cobaltstrike
Google	Detected
Avira	TR/CobaltStrike.muasi
MAX	malware (ai score=84)
Antiy-AVL	RiskWare/Win64.Artifact.a
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win64.Agent.oa!s1
Microsoft	Trojan:Win64/Bulz.SPVV!MTB
ViRobot	Trojan.Win.Z.Cobaltstrike.17920.ADU
ZoneAlarm	HEUR:Trojan.Win64.CobaltStrike.gen
GData	Gen:Variant.Bulz.405257
Varist	W64/Agent.NDUP
AhnLab-V3	Backdoor/Win.CobaltStrike.R360995
TACHYON	Trojan/W64.Agent.17920.C
DeepInstinct	MALICIOUS

artifact-64.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All