popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

qs.exe

Generic Malware Obsidium protector UPX Downloader Antivirus Malicious Library Malicious Packer ftp PE File PE64 DLL OS Processor Check BMP Format PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 5, 2024, 9:26 a.m. Aug. 5, 2024, 9:29 a.m.
Size 3.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, Nullsoft Installer self-extracting archive
MD5 80686d8a775b129d069d232978b94248
SHA256 1a87e111bfd5d1b730faa9f7f77f3e0d85eb9c3c8679d7f90c7160d1c989cb3d
CRC32 17FC74C0
ssdeep 98304:QMhCAKEwXPrQquKa0ce0ol1z1XMGgVOWTyGYKHiehURADe:Q7WKaHe0ol19Zede
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
ping3.dyngate.com
master16.teamviewer.com
A 185.188.32.26
185.188.32.26
IP Address Status Action
164.124.101.2 Active Moloch
185.188.32.26 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49177 -> 185.188.32.26:80 2009475 ET POLICY TeamViewer Dyngate User-Agent Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
Time & API Arguments Status Return Repeated

bind

 ip_address: 127.0.0.1
socket: 868
port: 0
1 0 0

listen

 socket: 868
backlog: 2147483647
1 0 0

accept

 ip_address:
socket: 868
port: 0
1 884 0

bind

 ip_address: 127.0.0.1
socket: 6108
port: 6039
1 0 0

listen

 socket: 6108
backlog: 2147483647
1 0 0

bind

 ip_address: 0.0.0.0
socket: 7064
port: 0
1 0 0
request GET http://master16.teamviewer.com/din.aspx?s=00000000&id=0&client=DynGate&rnd=142693444&p=10000001
request GET http://master16.teamviewer.com/dout.aspx?s=59766239&p=10000001&client=DynGate&data=FyQSkwCjHqkys5MkoZ6bHJmbmxubnJMkoh6YEyY3s7O0tzOemJMmoKGemDwcmjIymRucMZmZG5ovmLGwmBoZmLMyHDCxGLIxr5kYHBsbG5qbGRyTJqSiHpg8HJoyMpkbnDGZmRuaL5ixsJgaGZizMhwwsRiyMa+ZGBwbGxuamxkckyepnqu0txuTKx6bFxgXHJyaG5AoqaE=
request GET http://master16.teamviewer.com/din.aspx?s=59766239&id=0&client=DynGate&p=10000002
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10004000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10004000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x035a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Opera\Opera\operaprefs.ini
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_es.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_sv.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_pt.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\tv_x64.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_it.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\tv_w32.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\tv_x64.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ar.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_tr.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Desktop.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_da.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\tv_w32.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\TvGetVersion.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_fr.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_de.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ko.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_cs.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\nsis7z.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_en.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ru.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Service.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_fi.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_pl.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ja.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\ReadCustomerData.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_no.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_zh.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_nl.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer.exe
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\nsis7z.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ko.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ar.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_nl.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_pl.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_zh.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_fi.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_fr.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_tr.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\ReadCustomerData.dll
file C:\Users\test22\AppData\Local\Temp\nsxEF63.tmp\TvGetVersion.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ru.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_de.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_sv.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_cs.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_da.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_en.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\tv_w32.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Desktop.exe
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_ja.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_it.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_no.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_pt.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\tv_w32.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Resource_es.dll
file C:\Users\test22\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_Service.exe
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
1 0 0
section {u'size_of_data': u'0x00004600', u'virtual_address': u'0x00031000', u'entropy': 7.838627115962658, u'name': u'UPX1', u'virtual_size': u'0x00005000'} entropy 7.83862711596 description A section with a high entropy has been found
entropy 0.421686746988 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
mutex TeamViewer_Win32_Instance_Mutex
regkey HKEY_LOCAL_MACHINE\Software\TeamViewer\Version6\DefaultSettings\
regkey HKEY_LOCAL_MACHINE\SOFTWARE\TeamViewer3