Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 18, 2024, 10:50 p.m.	July 18, 2024, 10:55 p.m.

Size	2.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3a7da416e0ed02e02fa874f3ae09e9a2`
SHA256	`41cb5ed0263f85315caa04884a4c1afd191f5b3896e9e55bda08fe1b05780fc5`
CRC32	`A5DB4369`
ssdeep	`49152:t84yXpij2ZI9iAnQXC4aOLCXlhv0/xK9h162t/7qgptEunf7q677wgIVacP5blXA:tEAaI9uCWG1tzqK7q677wgI7P5blw`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	Malicious_Library_Zero - Malicious_Library Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

FAKE BTC SENDER zip.exe "C:\Users\test22\AppData\Local\Temp\FAKE BTC SENDER zip.exe"
2572
- CRACK.exe "C:\Users\test22\Desktop\CRACK.exe"
  2756

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
80.92.206.111	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 18, 2024, 10:50 p.m.			0	0
IsDebuggerPresent July 18, 2024, 10:50 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 18, 2024, 10:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048bf80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 10:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048bf80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 18, 2024, 10:50 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048c800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 18, 2024, 10:50 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00468000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2756 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

CRACK.exe tried to sleep 175 seconds, actually delayed analysis time by 175 seconds

Creates executable files on the filesystem (50 out of 105 events)

file	C:\Users\test22\Desktop\fake btc sender\System.Buffers.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Resources.Writer.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Linq.Parallel.dll
file	C:\Users\test22\Desktop\fake btc sender\System.AppContext.dll
file	C:\Users\test22\Desktop\fake btc sender\System.IO.FileSystem.Primitives.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Runtime.InteropServices.RuntimeInformation.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Collections.NonGeneric.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.Requests.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Xml.XPath.XDocument.dll
file	C:\Users\test22\Desktop\fake btc sender\System.ComponentModel.TypeConverter.dll
file	C:\Users\test22\Desktop\fake btc sender\System.ComponentModel.EventBasedAsync.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Runtime.Extensions.dll
file	C:\Users\test22\Desktop\fake btc sender\System.IO.UnmanagedMemoryStream.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Runtime.CompilerServices.VisualC.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Diagnostics.TextWriterTraceListener.dll
file	C:\Users\test22\Desktop\fake btc sender\System.ComponentModel.Primitives.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Threading.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Diagnostics.Tracing.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Diagnostics.Contracts.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Reflection.Extensions.dll
file	C:\Users\test22\Desktop\fake btc sender\System.IO.MemoryMappedFiles.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Globalization.Calendars.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.Sockets.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Linq.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Resources.ResourceManager.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Globalization.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Diagnostics.Process.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Diagnostics.Debug.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Drawing.Primitives.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Runtime.Numerics.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.WebSockets.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Text.Encoding.Extensions.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Threading.ThreadPool.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Runtime.InteropServices.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.NameResolution.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Security.Cryptography.Primitives.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Collections.Specialized.dll
file	C:\Users\test22\Desktop\CRACK.exe
file	C:\Users\test22\Desktop\fake btc sender\System.Xml.XPath.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Linq.Queryable.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.NetworkInformation.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.Primitives.dll
file	C:\Users\test22\Desktop\fake btc sender\System.IO.Compression.ZipFile.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.WebHeaderCollection.dll
file	C:\Users\test22\Desktop\fake btc sender\System.IO.FileSystem.DriveInfo.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Diagnostics.FileVersionInfo.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Security.Principal.dll
file	C:\Users\test22\Desktop\fake btc sender\System.IO.FileSystem.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Net.Http.dll
file	C:\Users\test22\Desktop\fake btc sender\System.Security.Cryptography.X509Certificates.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 18, 2024, 10:50 p.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef90000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 18, 2024, 10:50 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

80.92.206.111

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

80.92.206.111:80

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Trojan.Win32.NanoBot.trQD
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.MsilFC.S23227671
Skyhigh	BehavesLike.Win32.Generic.vc
ALYac	Gen:Variant.Jalapeno.273
Cylance	unsafe
VIPRE	Gen:Variant.Jalapeno.273
Sangfor	Infostealer.Msil.Redline.V5k9
K7AntiVirus	Spyware ( 0057a2c81 )
BitDefender	Gen:Variant.Jalapeno.273
K7GW	Spyware ( 0057a2c81 )
Arcabit	Trojan.Jalapeno.273 [many]
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Spy.RedLine.A
APEX	Malicious
McAfee	Artemis!3A7DA416E0ED
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	UDS:Trojan-PSW.MSIL.Reline.gen
Alibaba	TrojanPSW:MSIL/RedLine.3fc20884
MicroWorld-eScan	Gen:Variant.Jalapeno.273
Rising	Backdoor.SectopRAT!1.DA27 (CLASSIC)
Emsisoft	Trojan-Spy.Agent (A)
F-Secure	Heuristic.HEUR/AGEN.1305493
DrWeb	Trojan.PWS.RedLineNET.9
FireEye	Gen:Variant.Jalapeno.273
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.MSIL.Redline
Google	Detected
Avira	HEUR/AGEN.1305493
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Spy]/MSIL.Agent
Kingsoft	win32.pswtroj.undef.a
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	PWS:MSIL/RedLine!atmn
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Reline.gen
GData	MSIL.Trojan-Stealer.Redline.B (3x)
Varist	W32/S-1b09bef6!Eldorado
DeepInstinct	MALICIOUS
VBA32	Trojan.MSIL.RedLine.Heur
Malwarebytes	Malware.AI.1988720740
Panda	Trj/CI.A
Tencent	Msil.Trojan-QQPass.QQRob.Vmhl
Yandex	TrojanSpy.Agent!Ax+rEXWNMxo
SentinelOne	Static AI - Malicious SFX
Fortinet	MSIL/Agent.DFY!tr.spy
AVG	Win32:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

FAKE BTC SENDER zip.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All