Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 22, 2024, 5:43 p.m.	July 22, 2024, 5:45 p.m.

Size	37.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5133a39682e9f9c6b6245193d0e71c8a`
SHA256	`8b947486ed56599c2fbb60f77d60b3215e5f2dd5cda1fd94dafe5ca4825c217b`
CRC32	`670FC3A6`
ssdeep	`384:WkZTUiSmL1G5k2gyk/4sP9S/ksVW0erAF+rMRTyN/0L+EcoinblneHQM3epzXnNP:BZX32bk/4sYssVWbrM+rMRa8Nuprt`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_njRAT_Zero - Win Backdoor njRAT Generic_Malware_Zero - Generic Malware

Server.exe "C:\Users\test22\AppData\Local\Temp\Server.exe"
2548
netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Roaming\server.exe" "server.exe" ENABLE
2788

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 22, 2024, 5:43 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA July 22, 2024, 5:43 p.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1	0
WriteConsoleA July 22, 2024, 5:43 p.m.	buffer: Ok. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 22, 2024, 5:43 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00511000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 22, 2024, 5:43 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW July 22, 2024, 5:43 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Local\Temp\Server.exe filepath: C:\Users\test22\AppData\Local\Temp\Server.exe	1	1	0

File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.njrat.4!c
Elastic	Windows.Trojan.Njrat
CAT-QuickHeal	Backdoor.Bladabindi.B3
Skyhigh	BehavesLike.Win32.Trojan.nm
McAfee	Trojan-FIGN
Cylance	Unsafe
VIPRE	Gen:Heur.MSIL.Krypt.44
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
BitDefender	Gen:Heur.MSIL.Krypt.44
K7GW	Trojan ( 700000121 )
Cybereason	malicious.682e9f
Arcabit	Trojan.MSIL.Krypt.44
Baidu	MSIL.Backdoor.Bladabindi.a
VirIT	Trojan.Win32.DownLoader21.BPQW
Symantec	Backdoor.Ratenjay!gen3
ESET-NOD32	MSIL/Bladabindi.NZ
APEX	Malicious
Avast	MSIL:Bladabindi-JK [Trj]
ClamAV	Win.Packed.Bladabindi-7994427-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:MSIL/njRAT.5eccf7a3
NANO-Antivirus	Trojan.Win32.Autoruner2.ebrjyu
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.44
Rising	Backdoor.njRAT!1.9E49 (CLASSIC)
Emsisoft	Worm.Bladabindi (A)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.MulDrop6.39241
Zillya	Trojan.Bladabindi.Win32.74276
TrendMicro	BKDR_BLADABI.SMC
McAfeeD	Real Protect-LS!5133A39682E9
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.5133a39682e9f9c6
Sophos	Troj/Bbindi-W
Ikarus	Trojan.Inject
Jiangmin	TrojanDropper.Autoit.dce
Google	Detected
Avira	TR/ATRAPS.Gen
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Backdoor]/MSIL.Bladabindi.as
Kingsoft	malware.kb.c.1000
Gridinsoft	Ransom.Win32.Bladabindi.sa
Xcitium	TrojWare.MSIL.Spy.Agent.CP@4pqytu
Microsoft	Trojan:MSIL/njRAT.RDSA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	MSIL.Trojan-Spy.Bladabindi.BQ
Varist	W32/MSIL_Troj.AP.gen!Eldorado
AhnLab-V3	Trojan/Win32.Korat.R207428
BitDefenderTheta	Gen:NN.ZemsilF.36810.cmW@ayt01Ik

Server.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All