Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 9, 2024, 7:47 a.m.	Aug. 9, 2024, 7:52 a.m.

Size	709.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b7cb7f2b5cd9bd047710650295dc88f7`
SHA256	`e01c0429a58b33013305aab35ef863cd2b88962e479e39566a687ca37c68510f`
CRC32	`028D13CF`
ssdeep	`12288:9CwgCcyMy1Nncixi2NWXCAcrIQBjljKsFKfFDKZNF:9cCp9KGiAAcUwjljKAK8ZNF`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

buildz.exe "C:\Users\test22\AppData\Local\Temp\buildz.exe"
2332
- icacls.exe icacls "C:\Users\test22\AppData\Local\2c81248a-e050-4eea-84b5-148e01fb1dc7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2596
buildz.exe "C:\Users\test22\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
2784

Name	Response	Post-Analysis Lookup
cajgtus.com	A 201.233.78.169 A 2.185.214.11 A 200.63.106.141 A 183.100.39.16 A 148.230.249.9 A 78.89.199.216 A 154.144.253.197 A 186.182.55.44 A 190.249.193.233 A 190.98.23.157	200.63.106.141
api.2ip.ua	A 104.21.65.24 A 172.67.139.220	104.21.65.24

IP Address	Status	Action
104.21.65.24	Active	Moloch
164.124.101.2	Active	Moloch
2.185.214.11	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 104.21.65.24:443	2033214	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)	Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 104.21.65.24:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49171 -> 104.21.65.24:443	2033214	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)	Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 104.21.65.24:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49173 -> 2.185.214.11:80	2002400	ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 2.185.214.11:80	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	A Network Trojan was detected
TCP 2.185.214.11:80 -> 192.168.56.103:49173	2036335	ET MALWARE Win32/Filecoder.STOP Variant Public Key Download	A Network Trojan was detected
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2027026	ET POLICY External IP Address Lookup DNS Query (2ip .ua)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49165 104.21.65.24:443	C=US, O=Google Trust Services, CN=WE1	CN=2ip.ua	ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1
TLSv1 192.168.56.103:49171 104.21.65.24:443	C=US, O=Google Trust Services, CN=WE1	CN=2ip.ua	ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 9, 2024, 7:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2024, 7:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2024, 7:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2024, 7:48 a.m.	computer_name: TEST22-PC	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.yar
section	.befajam

Performs some HTTP requests (2 events)

request	GET http://cajgtus.com/lancer/get.php?pid=06280D9CD13939E9B7E95CDCAA6A83CC&first=true
request	GET https://api.2ip.ua/geo.json

Foreign language identified in PE resource (9 events)

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x00137a18

size

0x00000468

name

RT_GROUP_ICON

language

LANG_TURKISH

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x00137e80

size

0x00000076

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0009d000', u'virtual_address': u'0x00001000', u'entropy': 7.9697732091070135, u'name': u'.text', u'virtual_size': u'0x0009cea9'}

entropy

7.96977320911

description

A section with a high entropy has been found

entropy

0.886379675371

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.openssl.org/support/faq.html

Yara rule detected in process memory (40 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper

reg_value

"C:\Users\test22\AppData\Local\2c81248a-e050-4eea-84b5-148e01fb1dc7\buildz.exe" --AutoStart

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2332 resumed a thread in remote process 2656
NtResumeThread Aug. 9, 2024, 7:48 a.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 2656	1	0	0

Uses suspicious command line tools or Windows utilities (1 event)

cmdline

icacls "C:\Users\test22\AppData\Local\2c81248a-e050-4eea-84b5-148e01fb1dc7" /deny *S-1-1-0:(OI)(CI)(DE,DC)

buildz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All