Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 30, 2024, 1:35 p.m.	July 30, 2024, 1:39 p.m.

Size	11.0MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`dae181fa127103fdc4ee4bf67117ecfb`
SHA256	`f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980`
CRC32	`029917B4`
ssdeep	`49152:wdzUsKA6g3+fvby11dPgTdDdCSsYc30ZRiCXohOnCP+N8yG09rR/57WWTBtNUQ8d:cDGG09r957WWTv14E1pH3Xgb3kQ3`
Yara	Malicious_Library_Zero - Malicious_Library Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

Authenticator.exe "C:\Users\test22\AppData\Local\Temp\Authenticator.exe"
2540

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didata

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 region_size: 4513792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000040b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 region_size: 4513792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 region_size: 2682880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004950000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 region_size: 3125248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004be0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 3125248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 region_size: 3125248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140290000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory July 30, 2024, 1:28 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140290000 process_handle: 0xffffffffffffffff	1	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Agent.Y!c
Cylance	Unsafe
Sangfor	Trojan.Win64.Agent.Vymx
BitDefender	Trojan.GenericKD.73746891
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.CKBEAOT
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	Trojan.Win64.Agent.qwlmhp
MicroWorld-eScan	Trojan.GenericKD.73746891
Rising	Trojan.Undefined!8.1327C (C64:YzY0OjeX0RZXxN3W)
Emsisoft	Trojan.GenericKD.73746891 (B)
F-Secure	Trojan.TR/Agent.wbbmy
DrWeb	Trojan.Siggen29.9527
TrendMicro	Trojan.Win64.AMADEY.YXEG3Z
McAfeeD	ti!F18AFD984DF4
FireEye	Trojan.GenericKD.73746891
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Agent.wbbmy
MAX	malware (ai score=87)
Xcitium	Malware@#20wnes82zj2cv
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.Win64.Agent.qwlmhp
GData	Trojan.GenericKD.73746891
Varist	W64/ABTrojan.HQFW-0994
AhnLab-V3	Malware/Win.Generic.C5654106
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.MalPack
Ikarus	Trojan.SuspectCRC
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win64.AMADEY.YXEG3Z
huorong	Trojan/Generic!E20C1D57D6CE41AD
Fortinet	W32/PossibleThreat
AVG	Win64:MalwareX-gen [Trj]

Authenticator.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All