popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

UXSNUWNZ.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PNG Format PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 31, 2024, 7:25 a.m. July 31, 2024, 7:27 a.m.
Size 16.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 532d05ffeadbd71ebd3427d829a6759f
SHA256 cb25ccf6059c2f8a041f22e6fb110b7fbbc6cbdb4a5c35f0555cd735b5686a42
CRC32 A9243AFF
ssdeep 393216:Upw0Jt5ov09pHGru+gIo2Ci/3Bh1kYnXQS2BKKQqS6gjeXECSZEP6T:IwcUv00utILxhBXiBWqseXEbT
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
packer Armadillo v1.71
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00405000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72861000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 0
free_bytes_available: 13308088320
root_path: C:\Users\test22\AppData\Local\Temp
total_number_of_bytes: 0
1 1 0
file C:\Users\test22\AppData\Local\Temp\Gq_Stream.exe
file C:\Users\test22\AppData\Local\Temp\chrome_wer.dll
file C:\Users\test22\AppData\Local\Temp\vulkan-1.dll
file C:\Users\test22\AppData\Local\Temp\chrome_elf.dll
file C:\Users\test22\AppData\Local\Temp\Gq_Stream.exe
file C:\Users\test22\AppData\Local\Temp\Gq_Stream.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2736
thread_handle: 0x0000016c
process_identifier: 2732
current_directory:
filepath:
track: 1
command_line: C:\Windows\SysWOW64\more.com
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000170
1 1 0