popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

industries.exe

Generic Malware Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 26, 2024, 10:43 a.m. July 26, 2024, 10:47 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b77405e92a8557ab11d1d6ed25d6b390
SHA256 35e708ca54de7e0f81312a42ab72744b5ad5d1a6a3d2145104c154a3fb74c6a7
CRC32 6832D369
ssdeep 24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8al4WaFs5i/L:fTvC/MTQYxsWR7al4W+
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
request POST http://www.summitpublications.net/ra7c/
request GET http://www.summitpublications.net/ra7c/?MX7FkojV=SvKeswTuzWazx34ZRwNYWOUL+4Qzi3RGXdHaFUpExCUZEgDUs1lV719mAF8EtsBn/AVD65QVQa8ibY4gFbZqCpH5b+leOD1Jj6HueKbZfx9J0tpKEMSaJYca0b0uZ3KvEkzLgBc=&2Oj70=wymB9
request GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
request GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3370000.zip
request GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3280000.zip
request GET http://www.hyattcreekoutpost.biz/sz4t/?MX7FkojV=PqYvDSUa5xpzdedq5tdpwiJC3gthoupmRjBzzJ3FbntVibPZI1/EKZl9s9hOn0Zmb9xaCSNsWJoSe51ux6SQqL8VwrNWtNbiyPi6OavNpFulETA7IisDPhWpDVcfmzCLy1FFmkA=&2Oj70=wymB9
request GET http://www.coremagic.dev/rvsk/?MX7FkojV=Q6rrnvlrZTKYSle47xg6Y6OwSS9N0FqK+Mj9cH/UpKnUyMI1FWbgFk/FlNfWovow3hwVTGhvILolNNo3GNpr7hq9bWNUl6+SP6zUu/gjCFkqdjEUw+tJr6mTAbu4eV1uJ6YGGN8=&2Oj70=wymB9
request GET http://www.butlay.website/u759/?MX7FkojV=MCukImoArEyLOTWqdQ1z2ePajSp2A5/BJZ6VTOICmOwJAgwJdKZCqOuSR5fILSmCknZcGV/72lN4bKl6niuzWckaU42fOjXxFvVyCgHozLVBKAJAIlIa8E7shRk9RybY7kmvMQk=&2Oj70=wymB9
request GET http://www.tepco-co.online/hkxp/?MX7FkojV=gPAUIlTRKA7qXOL1ZTlMStdeIysZD39Vk2/re0B3mS8rGAQ0GotM5sSvAkfRsadCl6ftFGx2rGJjUrcRh8RdozefQI8XmfbOp1GwBEXiGavuSYQFbTIXZtPOAEv8EMoS+0xwku0=&2Oj70=wymB9
request GET http://www.balneo.shop/9kwt/?MX7FkojV=/fSY3QZdojWpNRWxwqctiQNAdxt1JuBXe68kaBTFsj+2jUSklURH6kjWh0GMyO+4mMP491VErEY7I0ob1VlJfdzB+SlT7K2iZIvlJJCUvillQoZjNNO9VKVTJ25PKBfJXbttaTY=&2Oj70=wymB9
request GET http://www.teandone.buzz/o6pn/?MX7FkojV=UJn6hLCr5CE83JGsiFr6F3dlh+gjmnQgpGSYIUWsdErR1O5ttgS2rCz/oa92Vy1JsAs4Vb0vhE186yqRppZqSaM6EjKfJ/MzG1s7XTw2DqO7xvMmiA2yEfwBZPs4V1K4aWoq150=&2Oj70=wymB9
request GET http://www.mospos.top/q66s/?MX7FkojV=WxU+nNp+nJpz7Op4b6PDRlI6uXxtCFalh3oS6b0UMJSG3vkyp0IBCXywBW0+wHruShb13AiiEAiVUnW1+sH/RYwiBhm8QqKdAs/yfan11L/sTt125NYKX4Rdp1lkm/iDq+nnZa4=&2Oj70=wymB9
request GET http://www.sweatequitypac.org/raxq/?MX7FkojV=x7NDGsgoCWTIEJ1tNCkkA1f2sMsJkFt2/Kg/6Gal8l5Ws0UwXECJP572vAzACYdkP61pUsrmPyJQfMGcau4sPIxMO6OtXz5Fl6YkZsF6thbJOhJ/u+Iz2uLJY5XPwE+BFsUyCr8=&2Oj70=wymB9
request POST http://www.summitpublications.net/ra7c/
domain www.mospos.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2636
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b50000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02170000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000046f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description taskkill.exe tried to sleep 148 seconds, actually delayed analysis time by 148 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
section {u'size_of_data': u'0x00059800', u'virtual_address': u'0x000d4000', u'entropy': 7.897232861989734, u'name': u'.rsrc', u'virtual_size': u'0x000596cc'} entropy 7.89723286199 description A section with a high entropy has been found
entropy 0.294529000411 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2640
thread_handle: 0x0000012c
process_identifier: 2636
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\industries.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000130
1 1 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Process injection Process 2548 called NtSetContextThread to modify thread in remote process 2636
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1505556
registers.edi: 0
registers.eax: 4199712
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000012c
process_identifier: 2636
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win64.Injects.ts93
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Injector.tc
ALYac Trojan.Generic.36624229
Cylance Unsafe
VIPRE Trojan.Generic.36624229
Sangfor Trojan.Win32.Save.a
BitDefender Trojan.Generic.36624229
VirIT Trojan.Win32.AutoIt_Heur.A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.Autoit.GEN
McAfee Artemis!B77405E92A85
Avast Win32:Malware-gen
ClamAV Win.Trojan.Autoit-10033720-0
Kaspersky Trojan.Win32.Strab.mmw
Alibaba Trojan:Win32/Strab.4339cf4b
MicroWorld-eScan Trojan.Generic.36624229
Rising Trojan.Injector/Autoit!1.F5AA (CLASSIC)
Emsisoft Trojan.Generic.36624229 (B)
F-Secure Trojan.TR/AD.ShellcodeCrypter.lcktc
McAfeeD Real Protect-LS!B77405E92A85
FireEye Generic.mg.b77405e92a8557ab
Sophos Troj/AutoIt-DGJ
Webroot W32.Adware.Gen
Google Detected
Avira TR/AD.ShellcodeCrypter.lcktc
MAX malware (ai score=84)
Kingsoft Win32.Trojan.Strab.mmw
Gridinsoft Ransom.Win32.Sabsik.sa
Microsoft Trojan:Win32/Strab.GP!MTB
ZoneAlarm Trojan.Win32.Strab.mmw
GData Trojan.Generic.36624229
Varist W32/ABTrojan.GPAM-2932
BitDefenderTheta Gen:NN.ZexaF.36810.mvW@aORe4zgi
DeepInstinct MALICIOUS
VBA32 Trojan-Downloader.Autoit.gen
Malwarebytes Trojan.Injector.AutoIt
Ikarus Trojan.Autoit
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R002H01GO24
Tencent Win32.Trojan.Strab.Ddhl
MaxSecure Trojan.Malware.300983.susgen
Fortinet AutoIt/Injector.AAD!tr
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)