popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

iscsicli.exe

Formbook Generic Malware .NET framework(MSIL) Malicious Library UPX AntiDebug ActiveXObject PE File DLL OS Processor Check PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 24, 2024, 10:53 a.m. May 24, 2024, 10:55 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ed7336086b1e5267c0d4863325956be2
SHA256 598c9ee3a50b02b46197c90c5b4b01542225dd6a38059b32e326930a2798c496
CRC32 29A33326
ssdeep 12288:JSu1SlCLvMZmeIlVOoLrIivhk9dqxCygRuJi2pkU5BD8db8FO/f/8RVad7WTpnbK:JSu1S82mBVrIiudqHsLBj8RCqiAAS7C
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • Javascript_ActiveXObject - Use ActiveXObject JavaScript
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:58297 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 198.12.241.35:80 2221033 SURICATA HTTP Request abnormal Content-Encoding header Generic Protocol Command Decode
TCP 192.168.56.101:49185 -> 67.223.117.189:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
domain www.touchclean.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02100000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02240000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00315000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0031b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00317000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0030a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00307000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00306000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00711000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00713000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73282000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 262144
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 12288
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00940000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00560000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2808
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02120000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description dfrgui.exe tried to sleep 160 seconds, actually delayed analysis time by 160 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\iscsicli.exe
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\iscsicli.exe
section {u'size_of_data': u'0x00136200', u'virtual_address': u'0x00002000', u'entropy': 7.0051830923193075, u'name': u'.text', u'virtual_size': u'0x00136144'} entropy 7.00518309232 description A section with a high entropy has been found
entropy 0.997988736927 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
buffer Buffer with sha1: b39c1f9d09a586b339a53a77540e5f5292c71097
buffer Buffer with sha1: 5029dfd269cb93c69ff1365ac3f6144d26b82382
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000220
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000220
1 0 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Process injection Process 2680 manipulating memory of non-child process 988
Time & API Arguments Status Return Repeated

NtMapViewOfSection

 section_handle: 0x0000004c
process_identifier: 988
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x04250000
allocation_type: 0 ()
section_offset: 0
view_size: 15900672
process_handle: 0x00000050
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL@å–]à  €0@0@.textD `
base_address: 0x001f0000
process_identifier: 2680
process_handle: 0x00000220
1 1 0

WriteProcessMemory

 buffer: 
base_address: 0xfffde008
process_identifier: 2680
process_handle: 0x00000220
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL@å–]à  €0@0@.textD `
base_address: 0x001f0000
process_identifier: 2680
process_handle: 0x00000220
1 1 0
Process injection Process 2572 called NtSetContextThread to modify thread in remote process 2680
Process injection Process 2680 called NtSetContextThread to modify thread in remote process 2808
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199808
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2680
1 0 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 589428
registers.edi: 0
registers.eax: 1093168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000064
process_identifier: 2808
1 0 0
Process injection Process 2572 resumed a thread in remote process 2680
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000224
suspend_count: 1
process_identifier: 2680
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2572
1 0 0

CreateProcessInternalW

 thread_identifier: 2684
thread_handle: 0x00000224
process_identifier: 2680
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\iscsicli.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\iscsicli.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\iscsicli.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000220
1 1 0

NtGetContextThread

 thread_handle: 0x00000224
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000220
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000220
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL@å–]à  €0@0@.textD `
base_address: 0x001f0000
process_identifier: 2680
process_handle: 0x00000220
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x001f1000
process_identifier: 2680
process_handle: 0x00000220
1 1 0

WriteProcessMemory

 buffer: 
base_address: 0xfffde008
process_identifier: 2680
process_handle: 0x00000220
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199808
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2680
1 0 0

NtResumeThread

 thread_handle: 0x00000224
suspend_count: 1
process_identifier: 2680
1 0 0

NtMapViewOfSection

 section_handle: 0x0000004c
process_identifier: 988
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x04250000
allocation_type: 0 ()
section_offset: 0
view_size: 15900672
process_handle: 0x00000050
1 0 0

NtGetContextThread

 thread_handle: 0x00000064
1 0 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 589428
registers.edi: 0
registers.eax: 1093168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000064
process_identifier: 2808
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2808
1 0 0

CreateProcessInternalW

 thread_identifier: 2084
thread_handle: 0x000003ec
process_identifier: 2080
current_directory:
filepath: C:\Program Files\Mozilla Firefox\firefox.exe
track: 1
command_line:
filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe
stack_pivoted: 0
creation_flags: 12 (CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x000003d0
1 1 0
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Agensla.i!c
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win32.Generic.th
ALYac Trojan.GenericKD.72811799
Cylance unsafe
VIPRE Trojan.GenericKD.72811799
Sangfor Infostealer.Msil.Formbook.Vvfp
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Trojan.GenericKD.72811799
K7GW Riskware ( 00584baa1 )
Arcabit Trojan.Generic.D4570517
VirIT Trojan.Win32.MSIL_Heur.A
Symantec Trojan.Gen.MBT
ESET-NOD32 Win32/Formbook.AK
APEX Malicious
McAfee Artemis!ED7336086B1E
Avast Win32:PWSX-gen [Trj]
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
NANO-Antivirus Trojan.Win32.KeyloggerNET.kndrmb
MicroWorld-eScan Trojan.GenericKD.72811799
Rising Stealer.Agensla!8.13266 (CLOUD)
Emsisoft Trojan.GenericKD.72811799 (B)
F-Secure Trojan.TR/AD.Swotter.kkgtx
DrWeb Trojan.KeyloggerNET.54
McAfeeD ti!598C9EE3A50B
FireEye Trojan.GenericKD.72811799
Sophos Troj/Krypt-AFZ
Ikarus Trojan.MSIL.Inject
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AD.Swotter.kkgtx
Antiy-AVL Trojan/Win32.FormBook
Kingsoft MSIL.Trojan-PSW.Agensla.gen
Microsoft Trojan:MSIL/Formbook.PADW!MTB
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Trojan.GenericKD.72811799
Varist W32/ABRisk.KAPT-2902
AhnLab-V3 Dropper/Win.DropperX-gen.C5623473
BitDefenderTheta Gen:NN.ZemsilCO.36804.nn0@a8vUoEf
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.Stealer.Generic
Panda Trj/Chgt.AD
Tencent Malware.Win32.Gencirc.140c8919
MAX malware (ai score=87)
MaxSecure Trojan.Malware.74499699.susgen
Fortinet PossibleThreat
AVG Win32:PWSX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)