Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 11, 2024, 9:15 a.m.	July 11, 2024, 9:32 a.m.

Size	4.0KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`98cfc67eed512ad39df7bcc60ca10812`
SHA256	`d6f56ecd19fa563766690c26b4032bb05086e00f5d23759e389ecfa7b37f55b6`
CRC32	`C30F9108`
ssdeep	`48:ilToH5bK7PoQOKl0hhfSY4kzxPuq/vG0gcbsMpJfvRuqS:uUbCPLlsNSY/Pu8gKNJx`
PDB Path	C:\Users\Lenovo\Desktop\XieBro-v3.3\Binaries\Release\Client\ShellcodeStager.pdb
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description)

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
3.115.14.110	Active	Moloch
194.187.251.115	Active	Moloch

No Suricata Alerts

No Suricata TLS

pdb_path

C:\Users\Lenovo\Desktop\XieBro-v3.3\Binaries\Release\Client\ShellcodeStager.pdb

Time & API	Arguments	Status	Return	Repeated
__exception__ July 11, 2024, 9:17 a.m.	stacktrace: 0x2129f28 payload+0x14b2 @ 0x13f4614b2 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: ee 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x2129f28 registers.r14: 0 registers.r15: 0 registers.rcx: 34603008 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1638368 registers.r11: 34603008 registers.r8: 0 registers.r9: 0 registers.rdx: -33149168 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 34603008 registers.r13: 0	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 11, 2024, 9:17 a.m.	process_identifier: 1704 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0

host	3.115.14.110
host	194.187.251.115

Bkav	W64.AIDetectMalware
ALYac	Gen:Variant.Tedy.576415
Cylance	Unsafe
VIPRE	Gen:Variant.Tedy.576415
BitDefender	Gen:Variant.Tedy.576415
Cybereason	malicious.eed512
Arcabit	Trojan.Tedy.D8CB9F
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	Win64/Agent.DTE
APEX	Malicious
Kaspersky	Trojan.Win64.Agent.qwjuww
MicroWorld-eScan	Gen:Variant.Tedy.576415
Rising	Trojan.ShellCodeRunner!1.FAEA (CLASSIC)
Emsisoft	Gen:Variant.Tedy.576415 (B)
FireEye	Gen:Variant.Tedy.576415
MAX	malware (ai score=86)
ZoneAlarm	Trojan.Win64.Agent.qwjuww
GData	Gen:Variant.Tedy.576415
CrowdStrike	win/malicious_confidence_60% (D)

dead_host

3.115.14.110:80

payload.exe