popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Delivery%2006.exe

Gen1 Formbook Process Kill Suspicious_Script_Bin Generic Malware UPX CryptGenKey Malicious Library FindFirstVolume
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 9, 2024, 9:10 a.m. June 9, 2024, 9:19 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 132e9cb76def326daa4088f99587b759
SHA256 b79f9bfe9b5ed9113deae47f91b1a2eeca20cf737aea051e70b224d6b88e0792
CRC32 B5F4DAB2
ssdeep 24576:IAHnh+eWsN3skA4RV1Hom2KXMmHaD2jZ9uUKhRDp2jPdsRm9Qf5:Ph+ZkldoPK8YaDCXoqjP9Q
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Process_Snapshot_Kill_Zero - Process Kill Zero
  • PE_Header_Zero - PE File Signature
  • FindFirstVolume_Zero - FindFirstVolume Zero
  • CryptGenKey_Zero - CryptGenKey Zero
  • Device_Check_Zero - Device Check Zero
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49171 -> 154.215.72.110:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 66.29.149.46:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 116.50.37.244:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 202.172.28.202:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 46.30.213.191:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.103:49188 -> 85.159.66.93:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.103:49191 -> 91.195.240.94:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
UDP 192.168.56.103:60225 -> 8.8.8.8:53 2045759 ET INFO Observed DNS Query to .zip TLD Misc activity
TCP 192.168.56.103:49195 -> 195.110.124.133:80 2045975 ET INFO HTTP Request to a *.zip Domain Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
request POST http://www.3xfootball.com/fo8o/
request GET http://www.3xfootball.com/fo8o/?5R=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&ERg=Lbajlol-F3v
request GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
request POST http://www.kasegitai.tokyo/fo8o/
request GET http://www.kasegitai.tokyo/fo8o/?5R=0LNqIGaAWMhMIMLOr1FzuAu+QFTp+Isr9lFre+yu3/9GvRNYi1uHghhDsQ/pqDAQ+wkUrFUIurr7TLyDqzId9vCn3h40hICDSYZjejM1bTxHHnFMxARLyMCZMUhSp6GMEGHL0HI=&ERg=Lbajlol-F3v
request POST http://www.goldenjade-travel.com/fo8o/
request GET http://www.goldenjade-travel.com/fo8o/?5R=LFKqyrcu7g1NCa8bIVnmntQ0zrEKrQSprIMLtaWgKJ9bBKQr4dsn0J7ZoYUgIJ+R6Sel8OhXEcHhC7LyM9bkgjIIu2U6i6kbe5asCJcEX28JEcHJIWfCjODnuc7OiogdzaMrHf8=&ERg=Lbajlol-F3v
request POST http://www.antonio-vivaldi.mobi/fo8o/
request GET http://www.antonio-vivaldi.mobi/fo8o/?5R=PTl5gU/3CD/Xhg5KAVLGoeqWcilDUK5FTZuVmm6gfrwSjnBrSraU5xyBGUoA1k9xMbAGIU7PLJqf1PTsNd74L3d6+NgzbyGN2pTsiSyIeh1B8hC/nFfIu9UZrk9ku3J39HvVUu8=&ERg=Lbajlol-F3v
request POST http://www.magmadokum.com/fo8o/
request GET http://www.magmadokum.com/fo8o/?5R=qL3nKp+YSjoaTomnND+fiETGbzpIgkHGMW8DXsDTZ4AADrD7Wpn1kxM1jYW2/C2WhyBblBh5NUSWrO5bZjyCcVkJYbxxq5QITB2h2xAyEikjbcoqZSmDOCeIE8A+B7hyBKIW8mw=&ERg=Lbajlol-F3v
request POST http://www.rssnewscast.com/fo8o/
request GET http://www.rssnewscast.com/fo8o/?5R=x3jV/ECx7FuzXOI+6CNaISj98UIEn47HyCIVaqWvGMMqpfz0YC5wNp/pxM1zEFNKv4nPeGfT8/lZrDaJmccs4488pD+gaHK32CxgTEs5a2vdBlM4hQBa8nlaMF5vesFSU19kJNk=&ERg=Lbajlol-F3v
request POST http://www.techchains.info/fo8o/
request GET http://www.techchains.info/fo8o/?5R=vefd0teQh+kbruh+iKW53cdcsQD4oFyRDgCUoL90YCYLczV+Hcc/VZ2eVbboy/u5EgiS3CnxBclKZHyNJ/4ALr08/A/SWk5lVGufGp2P4fG4f3GonqE4cYuaa0/JNC0RZIlRWrU=&ERg=Lbajlol-F3v
request POST http://www.elettrosistemista.zip/fo8o/
request POST http://www.3xfootball.com/fo8o/
request POST http://www.kasegitai.tokyo/fo8o/
request POST http://www.goldenjade-travel.com/fo8o/
request POST http://www.antonio-vivaldi.mobi/fo8o/
request POST http://www.magmadokum.com/fo8o/
request POST http://www.rssnewscast.com/fo8o/
request POST http://www.techchains.info/fo8o/
request POST http://www.elettrosistemista.zip/fo8o/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2052
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00330000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2356
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
description netbtugc.exe tried to sleep 164 seconds, actually delayed analysis time by 164 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.vbs
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
section {u'size_of_data': u'0x0005b600', u'virtual_address': u'0x000c8000', u'entropy': 7.894681180861047, u'name': u'.rsrc', u'virtual_size': u'0x0005b424'} entropy 7.89468118086 description A section with a high entropy has been found
entropy 0.31132879046 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2256
thread_handle: 0x0000013c
process_identifier: 2252
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\Delivery%2006.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000134
1 1 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Process injection Process 2208 called NtSetContextThread to modify thread in remote process 2252
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 982404
registers.edi: 0
registers.eax: 4199888
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000013c
process_identifier: 2252
1 0 0
Lionic Trojan.Win32.Autoit.l!c
CAT-QuickHeal Trojan.AgentSM.S6640043
Skyhigh BehavesLike.Win32.TrojanAitInject.tc
ALYac AIT:Trojan.Nymeria.6084
Cylance Unsafe
VIPRE AIT:Trojan.Nymeria.6084
Sangfor Trojan.Win32.Autoit.Vsfr
BitDefender AIT:Trojan.Nymeria.6084
Arcabit AIT:Trojan.Nymeria.D17C4 [many]
VirIT Trojan.Win32.AutoIt_Heur.A
Symantec Trojan.Gen.2
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.Autoit.GBA
APEX Malicious
McAfee Artemis!132E9CB76DEF
Avast Win32:Malware-gen
Kaspersky Trojan-Spy.Win32.Noon.bglv
Alibaba Trojan:Win32/AutoitInject.a1bf3e35
MicroWorld-eScan AIT:Trojan.Nymeria.6084
Emsisoft AIT:Trojan.Nymeria.6084 (B)
McAfeeD ti!B79F9BFE9B5E
FireEye AIT:Trojan.Nymeria.6084
Sophos Troj/AutoIt-DGJ
Ikarus Win32.Outbreak
Google Detected
MAX malware (ai score=86)
Kingsoft Win32.Trojan-Spy.Noon.bglv
Gridinsoft Ransom.Win32.Sabsik.sa
Microsoft Trojan:Win32/AutoitInject.OWAA!MTB
ZoneAlarm Trojan-Spy.Win32.Noon.bglv
GData AIT:Trojan.Nymeria.6084 (2x)
Varist W32/AutoIt.YE.gen!Eldorado
DeepInstinct MALICIOUS
VBA32 Trojan.Autoit.F
Malwarebytes Trojan.Injector.AutoIt
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.F0D1C00F524
Fortinet AutoIt/Injector.FZW!tr
AVG Win32:Malware-gen
Paloalto generic.ml
alibabacloud Trojan[spy]:Win/AutoitInject.OIZO3DGW