popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Delivery%2007.exe

Gen1 Formbook Process Kill Suspicious_Script_Bin Generic Malware Malicious Library FindFirstVolume
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 9, 2024, 9:11 a.m. June 9, 2024, 9:15 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b94b6c27e410388cd4e7dfeb352b75ce
SHA256 26833834efb8d0ff6dfea4c7cd8a66b89fb8c04e5142a0a077e0ded715098232
CRC32 0863A4C7
ssdeep 24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaOtBcxkHwFDu6T1D5:lh+ZkldoPK8YaOtOxkHCu8
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Process_Snapshot_Kill_Zero - Process Kill Zero
  • PE_Header_Zero - PE File Signature
  • FindFirstVolume_Zero - FindFirstVolume Zero
  • CryptGenKey_Zero - CryptGenKey Zero
  • Device_Check_Zero - Device Check Zero
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49173 -> 154.215.72.110:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 202.172.28.202:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 116.50.37.244:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49184 -> 46.30.213.191:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49188 -> 91.195.240.94:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 66.29.149.46:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49194 -> 23.227.38.74:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 85.159.66.93:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49192 -> 195.110.124.133:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49192 -> 195.110.124.133:80 2045975 ET INFO HTTP Request to a *.zip Domain Misc activity
TCP 192.168.56.101:49191 -> 195.110.124.133:80 2045975 ET INFO HTTP Request to a *.zip Domain Misc activity
UDP 192.168.56.101:52753 -> 164.124.101.2:53 2045759 ET INFO Observed DNS Query to .zip TLD Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
request POST http://www.3xfootball.com/fo8o/
request GET http://www.3xfootball.com/fo8o/?Q1=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&niTnW=y25C
request GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3290000.zip
request POST http://www.kasegitai.tokyo/fo8o/
request GET http://www.kasegitai.tokyo/fo8o/?Q1=0LNqIGaAWMhMIMLOr1FzuAu+QFTp+Isr9lFre+yu3/9GvRNYi1uHghhDsQ/pqDAQ+wkUrFUIurr7TLyDqzId9vCn3h40hICDSYZjejM1bTxHHnFMxARLyMCZMUhSp6GMEGHL0HI=&niTnW=y25C
request POST http://www.goldenjade-travel.com/fo8o/
request GET http://www.goldenjade-travel.com/fo8o/?Q1=LFKqyrcu7g1NCa8bIVnmntQ0zrEKrQSprIMLtaWgKJ9bBKQr4dsn0J7ZoYUgIJ+R6Sel8OhXEcHhC7LyM9bkgjIIu2U6i6kbe5asCJcEX28JEcHJIWfCjODnuc7OiogdzaMrHf8=&niTnW=y25C
request POST http://www.antonio-vivaldi.mobi/fo8o/
request GET http://www.antonio-vivaldi.mobi/fo8o/?Q1=PTl5gU/3CD/Xhg5KAVLGoeqWcilDUK5FTZuVmm6gfrwSjnBrSraU5xyBGUoA1k9xMbAGIU7PLJqf1PTsNd74L3d6+NgzbyGN2pTsiSyIeh1B8hC/nFfIu9UZrk9ku3J39HvVUu8=&niTnW=y25C
request POST http://www.magmadokum.com/fo8o/
request GET http://www.magmadokum.com/fo8o/?Q1=qL3nKp+YSjoaTomnND+fiETGbzpIgkHGMW8DXsDTZ4AADrD7Wpn1kxM1jYW2/C2WhyBblBh5NUSWrO5bZjyCcVkJYbxxq5QITB2h2xAyEikjbcoqZSmDOCeIE8A+B7hyBKIW8mw=&niTnW=y25C
request POST http://www.rssnewscast.com/fo8o/
request GET http://www.rssnewscast.com/fo8o/?Q1=x3jV/ECx7FuzXOI+6CNaISj98UIEn47HyCIVaqWvGMMqpfz0YC5wNp/pxM1zEFNKv4nPeGfT8/lZrDaJmccs4488pD+gaHK32CxgTEs5a2vdBlM4hQBa8nlaMF5vesFSU19kJNk=&niTnW=y25C
request POST http://www.techchains.info/fo8o/
request GET http://www.techchains.info/fo8o/?Q1=vefd0teQh+kbruh+iKW53cdcsQD4oFyRDgCUoL90YCYLczV+Hcc/VZ2eVbboy/u5EgiS3CnxBclKZHyNJ/4ALr08/A/SWk5lVGufGp2P4fG4f3GonqE4cYuaa0/JNC0RZIlRWrU=&niTnW=y25C
request POST http://www.elettrosistemista.zip/fo8o/
request GET http://www.elettrosistemista.zip/fo8o/?Q1=bO1UBvtoHFNUmlWB73HniX/lRhcpQxU1qF418M7UHpKKa2cgLZsmK6mwaSCrivds7LXL3uoK+MTOMGhYNdwtdjBMQu6yx1bfgOYvdpbzJPd/eSD2kHjCkD+QxgbYBRdZBXmxn1k=&niTnW=y25C
request POST http://www.donnavariedades.com/fo8o/
request GET http://www.donnavariedades.com/fo8o/?Q1=l+301ZvITCxaX9AA7VU8BaNl0giE4t3JgzctOQx29qSsrxX8kw490hU6vymbZWA2w8GmYCogcgx/MI4pNd8ITQiOXzox9fl9oCNBaJd4bIe7oyUKC5LhLVNYvjLZULJxgsfERiI=&niTnW=y25C
request POST http://www.3xfootball.com/fo8o/
request POST http://www.kasegitai.tokyo/fo8o/
request POST http://www.goldenjade-travel.com/fo8o/
request POST http://www.antonio-vivaldi.mobi/fo8o/
request POST http://www.magmadokum.com/fo8o/
request POST http://www.rssnewscast.com/fo8o/
request POST http://www.techchains.info/fo8o/
request POST http://www.elettrosistemista.zip/fo8o/
request POST http://www.donnavariedades.com/fo8o/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02780000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2668
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00990000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 135168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2792
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004180000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description netbtugc.exe tried to sleep 160 seconds, actually delayed analysis time by 160 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.vbs
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\directory\.exe
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
section {u'size_of_data': u'0x00061200', u'virtual_address': u'0x000c8000', u'entropy': 7.903942808101959, u'name': u'.rsrc', u'virtual_size': u'0x00061184'} entropy 7.9039428081 description A section with a high entropy has been found
entropy 0.324561403509 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2716
thread_handle: 0x00000144
process_identifier: 2712
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\Delivery%2007.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000013c
1 1 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Process injection Process 2712 manipulating memory of non-child process 988
Time & API Arguments Status Return Repeated

NtMapViewOfSection

 section_handle: 0x0000004c
process_identifier: 988
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x04250000
allocation_type: 0 ()
section_offset: 0
view_size: 18075648
process_handle: 0x00000050
1 0 0
Process injection Process 2668 called NtSetContextThread to modify thread in remote process 2712
Process injection Process 2712 called NtSetContextThread to modify thread in remote process 2792
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1834100
registers.edi: 0
registers.eax: 4199888
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000144
process_identifier: 2712
1 0 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2685128
registers.edi: 0
registers.eax: 824448
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000064
process_identifier: 2792
1 0 0
Lionic Trojan.Win32.Autoit.l!c
Skyhigh BehavesLike.Win32.TrojanAitInject.tc
ALYac AIT:Trojan.Nymeria.6093
Cylance Unsafe
VIPRE AIT:Trojan.Nymeria.6093
Sangfor Trojan.Win32.Autoit.V0jr
BitDefender Trojan.GenericKD.73071651
Arcabit Trojan.Generic.D45AFC23
VirIT Trojan.Win32.AutoIt_Heur.A
Symantec Trojan.Gen.2
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.Autoit.GBC
APEX Malicious
McAfee Artemis!B94B6C27E410
Avast Win32:Malware-gen
Kaspersky Trojan-Spy.Win32.Noon.bgmg
MicroWorld-eScan Trojan.GenericKD.73071651
Emsisoft Trojan.GenericKD.73071651 (B)
McAfeeD ti!26833834EFB8
FireEye Trojan.GenericKD.73071651
Sophos Troj/AutoIt-DGJ
Ikarus Win32.Outbreak
Google Detected
MAX malware (ai score=81)
Kingsoft Win32.Trojan-Spy.Noon.bgmg
Microsoft Trojan:Win32/Autoit!MTB
ZoneAlarm Trojan-Spy.Win32.Noon.bgmg
GData Win32.Trojan-Stealer.FormBook.VTRB7V
Varist W32/AutoIt.YE.gen!Eldorado
AhnLab-V3 Trojan/Win.Injector.C5632962
DeepInstinct MALICIOUS
VBA32 Trojan-Downloader.Autoit.gen
Malwarebytes Trojan.Injector.AutoIt
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.F0D1C00F524
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Injector_Autoit.GBC!tr
AVG Win32:Malware-gen
Paloalto generic.ml
alibabacloud Trojan[spy]:Win/Noon.bknz