popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

HNBC.txt.exe

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 27, 2024, 3 p.m. July 27, 2024, 3:02 p.m.
Size 483.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2b985c758a227407855e1d8e14f8863d
SHA256 1b7645def29702c924a9cff0a5234b8a697f6d89be75593a725cf8f7da8c7288
CRC32 70AFF019
ssdeep 6144:QXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cNz5Gv:QX7tPMK8ctGe4Dzl4h2QnuPs/ZoGcv
Yara
  • Network_Downloader - File Downloader
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • infoStealer_browser_b_Zero - browser info stealer
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
maveing.duckdns.org
A 192.3.101.142
192.3.101.142
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
192.3.101.142 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49163 -> 192.3.101.142:18576 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.102:49161 -> 192.3.101.142:18576 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
UDP 192.168.56.102:64513 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.102:64513 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.102:49163
192.3.101.142:18576 		None None None
TLS 1.3
192.168.56.102:49161
192.3.101.142:18576 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain maveing.duckdns.org
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3008
region_size: 102400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10017000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0
description HNBC.txt.exe tried to sleep 360 seconds, actually delayed analysis time by 360 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2226418
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000130
process_name: tvnserver.exe
process_identifier: 2580
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: pw.exe
process_identifier: 2692
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: taskhost.exe
process_identifier: 2828
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: cmd.exe
process_identifier: 2928
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: conhost.exe
process_identifier: 2936
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: HNBC.txt.exe
process_identifier: 3008
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: pw.exe
process_identifier: 3016
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: HNBC.txt.exe
process_identifier: 1368
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
2 0
file C:\Users\test22\AppData\Local\Temp\hhrrtdkereoho
file C:\Users\test22\AppData\Roaming\Digsby\digsby.dat
file C:\Users\test22\AppData\Roaming\MySpace\IM\users.txt
registry HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords
registry HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
registry HKEY_CURRENT_USER\Software\Paltalk
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a2a4
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 131355 0
registry HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Process injection Process 3008 called NtSetContextThread to modify thread in remote process 1368
Process injection Process 3008 called NtSetContextThread to modify thread in remote process 2328
Process injection Process 3008 called NtSetContextThread to modify thread in remote process 2404
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 1638384
registers.edi: 0
registers.eax: 4678260
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001c0
process_identifier: 1368
1 0 0

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 1638384
registers.edi: 0
registers.eax: 4583992
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001c0
process_identifier: 2328
1 0 0

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 1638384
registers.edi: 0
registers.eax: 4334086
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001c0
process_identifier: 2404
1 0 0
Process injection Process 3008 resumed a thread in remote process 1368
Process injection Process 3008 resumed a thread in remote process 2328
Process injection Process 3008 resumed a thread in remote process 2404
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 1368
1 0 0

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 2328
1 0 0

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 2404
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1184
thread_handle: 0x000001c0
process_identifier: 1368
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\HNBC.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\xnmyaszcvv"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002e4
1 1 0

NtGetContextThread

 thread_handle: 0x000001c0
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 1368
process_handle: 0x000002e4
1 0 0

NtMapViewOfSection

 section_handle: 0x0000035c
process_identifier: 1368
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x00400000
allocation_type: 0 ()
section_offset: 0
view_size: 491520
process_handle: 0x000002e4
1 0 0

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 1638384
registers.edi: 0
registers.eax: 4678260
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001c0
process_identifier: 1368
1 0 0

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 1368
1 0 0

CreateProcessInternalW

 thread_identifier: 2220
thread_handle: 0x000001c0
process_identifier: 2328
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\HNBC.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\hhrrtdkereoho"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002e4
1 1 0

NtGetContextThread

 thread_handle: 0x000001c0
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2328
process_handle: 0x000002e4
1 0 0

NtMapViewOfSection

 section_handle: 0x00000368
process_identifier: 2328
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x00400000
allocation_type: 0 ()
section_offset: 0
view_size: 401408
process_handle: 0x000002e4
1 0 0

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 1638384
registers.edi: 0
registers.eax: 4583992
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001c0
process_identifier: 2328
1 0 0

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 2328
1 0 0

CreateProcessInternalW

 thread_identifier: 2392
thread_handle: 0x000001c0
process_identifier: 2404
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\HNBC.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\jkxctvvyfmgmzfsz"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002e4
1 1 0

NtGetContextThread

 thread_handle: 0x000001c0
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2404
process_handle: 0x000002e4
1 0 0

NtMapViewOfSection

 section_handle: 0x00000364
process_identifier: 2404
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x00400000
allocation_type: 0 ()
section_offset: 0
view_size: 147456
process_handle: 0x000002e4
1 0 0

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 1638384
registers.edi: 0
registers.eax: 4334086
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001c0
process_identifier: 2404
1 0 0

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 2404
1 0 0

NtResumeThread

 thread_handle: 0x00000108
suspend_count: 1
process_identifier: 1368
1 0 0

NtResumeThread

 thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2328
1 0 0
Bkav W32.AIDetectMalware
Elastic Windows.Trojan.Remcos
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.RemcosIH.S31010159
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Generic.Remcos.13284579
Cylance Unsafe
VIPRE Generic.Remcos.13284579
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Generic.Remcos.13284579
K7GW Riskware ( 00584baa1 )
Cybereason malicious.58a227
Arcabit Generic.Remcos.DCAB4E3
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.Genus.UED
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Rescoms.V
APEX Malicious
McAfee Remcos-FDQO!2B985C758A22
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
NANO-Antivirus Trojan.Win32.Remcos.keikbt
SUPERAntiSpyware Trojan.Agent/Gen-Remcos
MicroWorld-eScan Generic.Remcos.13284579
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Generic.Remcos.13284579 (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb BackDoor.Remcos.433
Zillya Trojan.Rescoms.Win32.1521
McAfeeD Real Protect-LS!2B985C758A22
FireEye Generic.mg.2b985c758a227407
Sophos Mal/Remcos-B
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.Remcos.dyc
Google Detected
Avira BDS/Backdoor.Gen
MAX malware (ai score=89)
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Kingsoft Win32.Hack.Remcos.gen
Gridinsoft Ransom.Win32.Wacatac.oa!s1
Microsoft Backdoor:Win32/Remcos.GA!MTB
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Win32.Trojan.PSE.1OHYAG0
Varist W32/Trojan.SMWB-4856
AhnLab-V3 Backdoor/Win.Remcos.R625673
BitDefenderTheta Gen:NN.ZexaF.36810.ECW@a4Zb!zoi
DeepInstinct MALICIOUS
VBA32 Backdoor.Remcos