popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

newalp.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 11, 2024, 2:24 p.m. Aug. 11, 2024, 3:02 p.m.
Size 416.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6093bb59e7707afe20ca2d9b80327b49
SHA256 3acc0b21db1f774d15a1f1d8080aff0b8f83eefb70c5c673f1c6ed7b676cd6d3
CRC32 D3DAB0C0
ssdeep 12288:5HF6/qNlNVOOLNke4CcabJBP5u2uP/QpGdz1LoI:k0lNVOWNdpbLcQpsVoI
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
TCP 147.45.60.44:80 -> 192.168.56.101:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 147.45.60.44:80 -> 192.168.56.101:49166 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.196.11.123:80 -> 192.168.56.101:49165 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack
TCP 192.168.56.101:49174 -> 172.67.19.24:443 906200068 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) undefined
TCP 192.168.56.101:49168 -> 185.196.11.123:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation
TCP 192.168.56.101:49168 -> 185.196.11.123:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.196.11.123:80 -> 192.168.56.101:49168 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.196.11.123:80 -> 192.168.56.101:49168 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.196.11.123:80 -> 192.168.56.101:49168 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.196.11.123:80 -> 192.168.56.101:49168 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49168 -> 185.196.11.123:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
UDP 192.168.56.101:55146 -> 164.124.101.2:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49174
172.67.19.24:443 		None None None
TLS 1.3
192.168.56.101:49173
163.172.171.111:10943 		None None None
TLS 1.3
192.168.56.101:49175
212.47.253.124:14433 		None None None

suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.196.11.123/h9k4kfklCdszZ3/index.php
suspicious_features GET method with no useragent header suspicious_request GET http://stagingbyvdveen.com/get/setup2.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.196.11.123/FirstZ.exe
request POST http://185.196.11.123/h9k4kfklCdszZ3/index.php
request GET http://stagingbyvdveen.com/get/setup2.exe
request GET http://185.196.11.123/FirstZ.exe
request POST http://185.196.11.123/h9k4kfklCdszZ3/index.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00dc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003ef0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\1000002001\setup2.exe
file C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
file C:\Users\test22\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
file C:\Users\test22\AppData\Local\Temp\1000002001\setup2.exe
file C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
file C:\Users\test22\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
file C:\Users\test22\AppData\Local\Temp\1000002001\setup2.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000002001\setup2.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000002001\setup2.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $zÐÞÚ>±°‰>±°‰>±°‰Qlj%±°‰QÇ.‰±°‰Qlj»±°‰7É#‰3±°‰>±±‰A±°‰Qlj?±°‰QÇ*‰?±°‰QÇ-‰?±°‰Rich>±°‰PEL*Êeà  :AÐS @E=&€LŒ0DÐÜب9@ì.text   `.dataÐ×? |@À.sinukFDŒ@@.tacefu› D¦@@.rsrcÐÜ0DÞª@@èú(BNZn~’®ÂÖäô,@VfvŠ °ÀÒæÚ4Nbr„¢°¼Ðæü ,@VlvdTH6ôÄ ü삪¶ÄÖè"6FVj~š°ÂÒú 8P^lxŽš¨ÂÜèö&<Tnˆ˜ª¶ÀÒÚ6 ŠÆìþÔ䲆lTlg@mv@O¯@¥´@êÎ@±’@,Aw@ð?ð?33ÿ€ð?ð?33ð¿0C€€ÿatan2üS@xT@oj@UT@UT@UT@oj@UT@mj@mj@—j@mj@xT@xT@oj@Öj@ÿÿÿÿÿÿï˜À˜@ð(null)(null)EEE50P( 8PX700WP `h````xpxxxxð?1mm.¹s¿,´)¼¦¹?à'>¼ð?ûi­“¿ ¦i<¸øÈ?Àmb¼ð?Z"“ê ¦¿ŸÕ.”Ò? Òu¼ð?ϕk†¡|³¿c©®¦â}Ø?àí,g¼ð?yúsh:¾¿;ö8]+Þ? ‰ ^<ð?tyÅ[g’Å¿Èh®9;Çá? Ý%‹<ð?ý¢«Sþ Í¿Ö %óLä? jh<ð?2ïü™y‚Ê?Í;fž æ? 4݋¼à?Xw$”Ì3Á?Ak€¼è? áł¼à?‡Œæš³s¬?£¡)f›ê?à0ö9<à?Nœ,J¿±½€ñ²8ì?€±àv¼à?uZEeu¾¿F2Ïkí? æWt<à?-ø¬v1 ¤?Ú-ÆVAŸî?à±`‡<Ð?ÕgY¬¿°\÷ϗbï? bu<Ð?P/Ye¡›¿&%Ñ£Øï?@ö}ˆ¼À?ð?P/Ye¡›?&%Ñ£Øï?@ö}ˆ¼À¿ÕgY¬?°\÷ϗbï? bu<п-ø¬v1 ¤¿Ú-ÆVAŸî?à±`‡<пuZEeu¾?F2Ïkí? æWt<à¿Nœ,J?±½€ñ²8ì?€±àv¼à¿‡Œæš³s¬¿£¡)f›ê?à0ö9<à¿Xw$”Ì3Á¿Ak€¼è? áł¼à¿2ïü™y‚Ê¿Í;fž æ? 4݋¼à¿ý¢«Sþ Í?Ö %óLä? jh<ð¿tyÅ[g’Å?Èh®9;Çá? Ý%‹<ð¿yúsh:¾?;ö8]+Þ? ‰ ^<ð¿Ï•k†¡|³?c©®¦â}Ø?àí,g¼ð¿Z"“ê ¦?ŸÕ.”Ò? Òu¼ð¿ûi­“? ¦i<¸øÈ?Àmb¼ð¿1mm.¹s?,´)¼¦¹?à'>¼ð¿ð¿1mm.¹s?,´)¼¦¹¿à'><ð¿ûi­“? ¦i<¸øÈ¿Àmb<ð¿Z"“ê ¦?ŸÕ.”Ò¿ Òu<ð¿Ï•k†¡|³?c©®¦â}Ø¿àí,g<ð¿yúsh:¾?;ö8]+Þ¿ ‰ ^¼ð¿tyÅ[g’Å?Èh®9;Çá¿ Ý%‹¼ð¿ý¢«Sþ Í?Ö %óLä¿ jh¼ð¿2ïü™y‚Ê¿Í;fž æ¿ 4݋<à¿Xw$”Ì3Á¿Ak€¼è¿ áł<࿇Œæš³s¬¿£¡)f›ê¿à0ö9¼à¿Nœ,J?±½€ñ²8쿀±àv<à¿uZEeu¾?F2Ïkí¿ æWt¼à¿-ø¬v1 ¤¿Ú-ÆVAŸî¿à±`‡¼Ð¿ÕgY¬?°\÷ϗbï¿ bu¼Ð¿P/Ye¡›?&%Ñ£Øï¿@ö}ˆ<À¿ð¿P/Ye¡›¿&%Ñ£Øï¿@ö}ˆ<À?ÕgY¬¿°\÷ϗbï¿ bu¼Ð?-ø¬v1 ¤?Ú-ÆVAŸî¿à±`‡¼Ð?uZEeu¾¿F2Ïkí¿ æWt¼à?Nœ,J¿±½€ñ²8쿀±àv<à?‡Œæš³s¬?£¡)f›ê¿à0ö9¼à?Xw$”Ì3Á?Ak€¼è¿ áł<à?2ïü™y‚Ê?Í;fž æ¿ 4݋<à?ý¢«Sþ Í¿Ö %óLä¿ jh¼ð?tyÅ[g’Å¿Èh®9;Çá¿ Ý%‹¼ð?yúsh:¾¿;ö8]+Þ¿ ‰ ^¼ð?ϕk†¡|³¿c©®¦â}Ø¿àí,g<ð?Z"“ê ¦¿ŸÕ.”Ò¿ Òu<ð?ûi­“¿ ¦i<¸øÈ¿Àmb<ð?1mm.¹s¿,´)¼¦¹¿à'><ð?
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEd†œÒ®eð" ’(@@0)`¨Ë<)ˆÐ(Œ )x °(´8@ÍX.textV’ `.rdataü"°$–@@.dataé'àÖ'º@À.pdataŒÐ((@@.00cfgà(’(@@.tlsð(”(@À.rsrcˆ)–(@@.relocx )¬(@BVHƒì H‹ ÇH‹ ÇH‹ ÇH‹ ՟·1ÀúMZuKHcQ<<PEu>HÑ·Qú tú u'ƒytr!HÁè냹„rHÁø1Àƒ9•ÀH‹ ŽŸƒ9‰¡£(¹ƒÙèŽH‹ٟ‹0è ‰0H‹¹Ÿ‹0èê‰0èƒH‹,Ÿƒ8u H è 1ÀHƒÄ ^ÃHƒì(H‹•Ÿ‹‰=£(H6£(H‹ oŸD‹ H‰D$ H $£(H!£(L"£(è}HƒÄ(ÀHƒì(H‹՞Çè HƒÄ(ÃfAWAVVWSHƒì eH‹%0H‹xH‹5ɞ1ÀðH±>”Ãt.H9Çt)L‹5Ù¼f„¹èAÿÖ1ÀðH±>”ÃtH9ÇuçH‹=ž‹ƒøu ¹èÿŒë'ƒ?t Æy¢(ëÇH‹ zžH‹{žèöŒ‹ƒøuH‹ PžH‹Qžè܌Ç„Ût1ÀH‡H‹æH‹H…Àt1ɺE1ÀÿÆÍ(è9H  ÿ¼H‹ åH‰H +è& èHc=Ρ(H ý蝌H‰ÆH…ÿ~G‰ûL‹5´¡(E1ÿf„K‹ þ藌HxH‰ùèkŒJ‰þK‹þH‰ÁI‰øèhŒIÿÇL9ûuÐë1ÛHÇÞH‰5e¡(èØH‹a¡(H‹ "H‹ H‰‹ B¡(H‹?¡(L‹@¡(è )‰A¡(ƒ=¡(t €=-¡(u 讋‹$¡(HƒÄ [_^A^A_ÉÁèŋÌ@Hƒì(H‹ŜÇèúýÿÿHƒÄ(ÃfHƒì(臋1ÉHƒøɉÈHƒÄ(ÄÃÌÌÌXH‰L$H‰T$L‰D$L‰L$ Hƒì(‹ MÌ舆‰NÌH1Éè*‰H‰CÌH1À‹6ÌHƒÄ(H‹L$H‹T$L‹D$L‹L$ I‰Ê ÌÿÌÿ5ÌÃÇòË’ èÿÿÿÇãËQ²?èrÿÿÿÇÔË= C}ècÿÿÿÇÅËÈ\%,èTÿÿÿǶËÅ$VèEÿÿÿǧ˲Śè6ÿÿÿǘË{ºÛ8è'ÿÿÿÇ‰Ë TñèÿÿÿÇzËhypüè ÿÿÿÇkËÁÜRÔèúþÿÿÇ\ËÑú_ÓèëþÿÿÇMË`4*ÞèÜþÿÿÇ>˃€èÍþÿÿÇ/˅’‡è¾þÿÿÇ ËǛ*éè¯þÿÿÇË]laàè þÿÿÇËËKÓàè‘þÿÿÇóÊُâè‚þÿÿÇäÊ>ÄèsþÿÿÇÕÊ£®~èdþÿÿÇÆÊ6™ÿ8èUþÿÿÇ·ÊëË?ìèFþÿÿǨÊn©™è7þÿÿÇ™Ê)?âè(þÿÿÇŠÊ5¥@dèþÿÿÇ{Êq¼²è þÿÿÇlʝµ¨èûýÿÿÇ]ÊìlÃèìýÿÿÇNÊ_ôèÝýÿÿÇ?ʄœÍ=èÎýÿÿÇ0Ê<]]Êè¿ýÿÿÇ!Ênö…†è°ýÿÿÇÊEÀ†”è¡ýÿÿÌÌÌÌÌÌÌÌÌÌÌÌÌHƒì(H‹ ÊH‹H…Àt.ffff.„ÿâÉ(H‹ëÉHHH‰ àÉH‹@H…ÀußHƒÄ(Ãf.„VWSHƒì H‹5:š‹ƒøÿu¸ÿÿÿÿfDHÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿmÉ(Hÿ˅ÿH‰ßuëH TÿÿÿHƒÄ [_^é¸üÿÿ„VWSHƒì €=’(tHƒÄ [_^ÃƁ(H‹5²™‹ƒøÿu¸ÿÿÿÿfffff.„HÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿÝÈ(Hÿ˅ÿH‰ßuëH ÄþÿÿHƒÄ [_^é(üÿÿÌÌÌÌÌÌÌÌ1ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌVWHƒì(H‹c™ƒ8tǃút<ƒúuAH5¿³H=¸³H9÷uë,f„HƒÇH9þtH‹H…ÀtïÿQÈ(ëçºè ¸HƒÄ(_^Ð1ÀÃffff.„Hƒì(ƒút…Òuèî¸HƒÄ(ÃÌÌÌÌVWHƒì8H‰Î‹ÿȃøwH˜H љHc<HÏëH=†™¹è[ L‹NFòN òL$0D$ Hk™H‰ÁI‰øè1‡1ÀHƒÄ8_^ÃÌÌÌÌÌÌÌÌÛãÃÌÌÌÌÌÌÌÌÌÌÌÌÌUAWAVAUATVWSHƒìHl$€=ü›(…mÆï›(Hƒì èn HƒÄ H˜H€HÅHƒàðè“ H)ÄH‰àH‰ƛ(Çě(H‹=ŚH‰øH+ÚHƒøŽH‹²šH‰øH)ØHƒø |,H‹Ÿšƒ;u/H‹“šƒ{u"H‹†šHX ƒxHE؃;u ƒ{„ÓH;\šsHL‹5«–Huffffff.„‹‹KB1Lñ‰EHƒì A¸H‰òèHƒÄ HƒÃH9ûrҋ›(…À~g¿H‹ìš(1ÛHuøL‹5¿´ëffff.„HÿÃHcÈHƒÇ(H9Ë}0D‹D:ðE…ÀtçH‹L:øH‹:Hƒì I‰ñAÿÖHƒÄ H‹™š(‹›š(ëÁHe[_^A\A]A^A_]ËSƒú…[HƒÃ H;y™ƒaÿÿÿL‹5ĕL=½—A¼‹HuøI½ÿÿÿÿëffffff.„HƒÃ H9ûƒ!ÿÿÿ‹KA‰ÈAàøAƒÀøA¬ÈAƒø‡×‹‹CLðN‹ 2Oc‡MúAÿâD¶M“ÿÿÿE„ÛëD·M“ÿÿfE…Ûë D‹O+E…ÛMIÓëL‹LòI)ÒMÊL‰Uø¶Ñƒú?w&IÇÃÿÿÿÿ‰ÑIÓãI÷ÓM9ÚLJÿIÇÃÿÿÿÿIÓãM9Ú|:Aƒø‡DÿÿÿE£Äƒ:ÿÿÿIcÈH0˜L‹ÊHƒì H‰ÁH‰òèMHƒÄ éÿÿÿHƒì0L‰T$ H —I‰Àè̶ÑHƒì H ؖè¹Hƒì H ––è©Ì„AWAVATVWSHƒìXL‰ÇH‰ÓH‰ÎD‹=ë˜(E…ÿ~GH‹ט(J ýH ‰1Òë€HƒÂ(H9Ñt#L‹DI9ðwíL‹L E‹IMÈI
request_handle: 0x00cc000c
1 1 0
host 185.196.11.123
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file C:\Windows\Tasks\Hkbsse.job
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Amadey.a!c
Elastic Windows.Generic.Threat
Cynet Malicious (score: 100)
CAT-QuickHeal TrojanDropper.Agent
Skyhigh BehavesLike.Win32.Downloader.gh
ALYac Gen:Variant.Doina.48774
Cylance Unsafe
VIPRE Gen:Variant.Doina.48774
Sangfor Downloader.Win32.Amadey.Vvpq
K7AntiVirus Trojan-Downloader ( 005790d31 )
BitDefender Gen:Variant.Doina.48774
K7GW Trojan-Downloader ( 005790d31 )
Cybereason malicious.9e7707
Arcabit Trojan.Doina.DBE86
Baidu Win32.Trojan.Delf.in
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
McAfee Artemis!6093BB59E770
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Malware.Generic-10033391-0
Kaspersky HEUR:Trojan-Downloader.Win32.Deyma.gen
Alibaba TrojanDownloader:Win32/Deyma.684c267b
MicroWorld-eScan Gen:Variant.Doina.48774
Rising Dropper.Agent!8.2F (TFE:5:7rIQ0Y4iUJR)
Emsisoft Gen:Variant.Doina.48774 (B)
F-Secure Heuristic.HEUR/AGEN.1375090
DrWeb Trojan.MulDrop28.2621
Zillya Downloader.Amadey.Win32.446
TrendMicro Trojan.Win32.AMADEY.YXEHFZ
McAfeeD Real Protect-LS!6093BB59E770
Trapmine malicious.high.ml.score
FireEye Generic.mg.6093bb59e7707afe
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Webroot W32.Trojan.Gen
Google Detected
Avira HEUR/AGEN.1375090
MAX malware (ai score=87)
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Kingsoft Win32.HeurC.KVMH017.a
Gridinsoft Trojan.Win32.Amadey.tr
Microsoft Trojan:Win32/Multiverze
ZoneAlarm HEUR:Trojan-Downloader.Win32.Deyma.gen
GData Gen:Variant.Doina.48774
Varist W32/Agent.HSX.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R659224
BitDefenderTheta AI:Packer.076EBC041F
DeepInstinct MALICIOUS