Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 29, 2024, 1:25 p.m.	July 29, 2024, 1:51 p.m.

Size	421.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ae3dd2f4488753b690ca17d555147aba`
SHA256	`77bdb3c46654446f1edffd1a388e3f64d8ca4dc24acd9575b95e94c26b8b43fe`
CRC32	`C85F89A4`
ssdeep	`6144:aPvOGvTbPoC8lV5AdpKndv8w7UkvKw1SthsFLDXW7nX9TCR/QYZuWDv7ZNk:aPzv3PL8lV6IxV/Kmes1Dm5SQYZuWX`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

svhostc.exe "C:\Users\test22\AppData\Local\Temp\svhostc.exe"
2560
- svhostc.exe "C:\Users\test22\AppData\Local\Temp\svhostc.exe"
  2660

Name	Response	Post-Analysis Lookup
api.telegram.org	A 149.154.167.220	149.154.167.220

IP Address	Status	Action
149.154.167.220	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2033966	ET HUNTING Telegram API Domain in DNS Lookup	Misc activity
TCP 192.168.56.101:49164 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.101:49164 -> 149.154.167.220:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.101:49166 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.101:49166 -> 149.154.167.220:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49166 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 149.154.167.220:443 -> 192.168.56.101:49167	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49166 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.101:49164 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 29, 2024, 1:25 p.m.	computer_name:		0	0
GetComputerNameW July 29, 2024, 1:25 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 29, 2024, 1:25 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.zitebej
section	.sahezin

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 29, 2024, 1:25 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 270336 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0263e000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 29, 2024, 1:25 p.m.	process_identifier: 2560 region_size: 503808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW July 29, 2024, 1:25 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\MyHiddenFolder filepath: C:\Users\test22\AppData\Roaming\MyHiddenFolder	1	1	0
SetFileAttributesW July 29, 2024, 1:25 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\MyHiddenFolder\svhostc.exe filepath: C:\Users\test22\AppData\Roaming\MyHiddenFolder\svhostc.exe	1	1	0

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW July 29, 2024, 1:25 p.m.	newfilepath_r: C:\Users\test22\AppData\Roaming\MyHiddenFolder\svhostc.exe flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Temp\svhostc.exe newfilepath: C:\Users\test22\AppData\Roaming\MyHiddenFolder\svhostc.exe oldfilepath: C:\Users\test22\AppData\Local\Temp\svhostc.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00049c00', u'virtual_address': u'0x00001000', u'entropy': 7.949015515367575, u'name': u'.text', u'virtual_size': u'0x00049b30'}

entropy

7.94901551537

description

A section with a high entropy has been found

entropy

0.701545778835

description

Overall entropy of this PE file is high

Yara rule detected in process memory (11 events)

description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over HTTP	rule	Network_HTTP
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 29, 2024, 1:25 p.m.	process_identifier: 2660 region_size: 516096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\My Program

reg_value

C:\Users\test22\AppData\Roaming\MyHiddenFolder\svhostc.exe

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 29, 2024, 1:25 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2660 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 called NtSetContextThread to modify thread in remote process 2660
NtSetContextThread July 29, 2024, 1:25 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4434029 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2660	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 resumed a thread in remote process 2660
NtResumeThread July 29, 2024, 1:25 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2660	1	0	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 29, 2024, 1:25 p.m.	thread_identifier: 2664 thread_handle: 0x0000007c process_identifier: 2660 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svhostc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\svhostc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\svhostc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread July 29, 2024, 1:25 p.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection July 29, 2024, 1:25 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2660 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory July 29, 2024, 1:25 p.m.	process_identifier: 2660 region_size: 516096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory July 29, 2024, 1:25 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2660 process_handle: 0x00000080	1	1
NtSetContextThread July 29, 2024, 1:25 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4434029 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2660	1	0
NtResumeThread July 29, 2024, 1:25 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2660	1	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Injuke.16!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Lockbit.gh
ALYac	Gen:Variant.Jaik.236336
Cylance	Unsafe
VIPRE	Gen:Variant.Jaik.236336
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005649fd1 )
BitDefender	Gen:Variant.Midie.151499
K7GW	Trojan ( 005649fd1 )
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.HXPN
APEX	Malicious
McAfee	Artemis!AE3DD2F44887
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packer.pkr_ce1a-9980177-0
Kaspersky	HEUR:Trojan.Win32.Injuke.gen
Alibaba	Trojan:Win32/Kryptik.bd287a59
MicroWorld-eScan	Gen:Variant.Midie.151499
Rising	Trojan.SmokeLoader!1.FF9D (CLASSIC)
Emsisoft	Gen:Variant.Midie.151499 (B)
F-Secure	Trojan.TR/AVI.AceCrypter.ojldh
DrWeb	Trojan.Inject5.6654
TrendMicro	Trojan.Win32.AMADEY.YXEG2Z
McAfeeD	Real Protect-LS!AE3DD2F44887
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.ae3dd2f4488753b6
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/AVI.AceCrypter.ojldh
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Convagent
Kingsoft	malware.kb.a.1000
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Multiverze
ZoneAlarm	HEUR:Trojan.Win32.Injuke.gen
GData	Gen:Variant.Midie.151499
Varist	W32/ABTrojan.OGWN-0279
AhnLab-V3	Trojan/Win.PWSX-gen.C5653856
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36810.Ay0@amtYgpiG
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.MalPack.GS
Ikarus	Trojan.Win32.Crypt
Panda	Trj/Chgt.AD

svhostc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All