Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 27, 2024, 6:21 p.m.	June 27, 2024, 6:23 p.m.

Size	7.8MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`e920056a531d4a0635ba526fabeda4ce`
SHA256	`133359336ed60b94e9cd500fb518a72fe8711c4a8f8fc83ef2cc242173d8cb96`
CRC32	`C95E647B`
ssdeep	`196608:qBqD8pA1HeT39IigQd++vvKub75bcjWgbkzfQAkj0WlT:58C1+TtIiLdNvvB5IjWqkze`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature ASPack_Zero - ASPack packed file IsPE64 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

system.exe "C:\Users\test22\AppData\Local\Temp\system.exe"
2064
- system.exe "C:\Users\test22\AppData\Local\Temp\system.exe"
  2232

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 27, 2024, 6:21 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 27, 2024, 6:21 p.m.	stacktrace: 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x7fef7c97ef8 registers.r14: 0 registers.r15: 196974 registers.rcx: 196974 registers.rsi: 1 registers.r10: 196974 registers.rbx: 0 registers.rsp: 3439448 registers.r11: 0 registers.r8: 1 registers.r9: 0 registers.rdx: 28 registers.r12: 0 registers.rbp: 10654880 registers.rdi: 0 registers.rax: 3439552 registers.r13: 28	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 27, 2024, 6:21 p.m.

stacktrace:

0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x7fef7c97ef8
registers.r14: 0
registers.r15: 196974
registers.rcx: 196974
registers.rsi: 1
registers.r10: 196974
registers.rbx: 0
registers.rsp: 3439448
registers.r11: 0
registers.r8: 1
registers.r9: 0
registers.rdx: 28
registers.r12: 0
registers.rbp: 10654880
registers.rdi: 0
registers.rax: 3439552
registers.r13: 28

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\_MEI20642\VCRUNTIME140.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI20642\libcrypto-3.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI20642\libssl-3.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI20642\python312.dll

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000f600', u'virtual_address': u'0x00046000', u'entropy': 7.554967714213718, u'name': u'.rsrc', u'virtual_size': u'0x0000f41c'}

entropy

7.55496771421

description

A section with a high entropy has been found

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Casdet.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win64.Agent.wc
ALYac	Trojan.GenericKD.73272188
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73272188
Sangfor	Trojan.Win32.Save.a
BitDefender	Trojan.GenericKD.73272188
Arcabit	Trojan.Generic.D45E0B7C
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Generik.FOCPLLP
Avast	FileRepMalware [Misc]
MicroWorld-eScan	Trojan.GenericKD.73272188
Emsisoft	Trojan.GenericKD.73272188 (B)
F-Secure	Trojan.TR/Casdet.qydfq
Zillya	Trojan.Agent.Win32.3856579
McAfeeD	ti!133359336ED6
FireEye	Trojan.GenericKD.73272188
Sophos	Mal/Generic-S
Jiangmin	Trojan.PSW.Disco.gub
Google	Detected
Avira	TR/Casdet.qydfq
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Agent
Kingsoft	Win32.Troj.Unknown.a
Xcitium	Malware@#250owe702lp27
Microsoft	Trojan:Win32/Casdet!rfn
GData	Trojan.GenericKD.73272188
Varist	W64/ABRisk.IVIW-8656
AhnLab-V3	Trojan/Win.Casdet.C5644141
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.Python
Tencent	Win32.Trojan.Malware.Szfl
SentinelOne	Static AI - Suspicious PE
Fortinet	Malicious_Behavior.SB
AVG	FileRepMalware [Misc]
CrowdStrike	win/malicious_confidence_100% (W)

system.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All