Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 12, 2024, 8:51 a.m.	Aug. 12, 2024, 9:01 a.m.

Size	21.4MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`7682909e9bda1e07a178ee76c114e42c`
SHA256	`c9c2671d59e747d93585102e1af0215aaa8e9680c5616f17599380e5209a0d0d`
CRC32	`34249EEE`
ssdeep	`196608:ZBws4UYoeoQhEmVgRq8syfKmRQpBVZrasK5hTuAvYct:ZcoeoQhEmGLQph6UuX`
Yara	Malicious_Library_Zero - Malicious_Library Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

Authenticator222.exe "C:\Users\test22\AppData\Local\Temp\Authenticator222.exe"
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didata

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 region_size: 5361664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 region_size: 5361664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000005030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 region_size: 2732032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000005550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 region_size: 3178496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000057f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 3178496 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 region_size: 3178496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014029d000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 12, 2024, 8:51 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014029d000 process_handle: 0xffffffffffffffff	1	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Bkav	W32.Common.F5A9998A
Lionic	Trojan.Win32.Agent.Y!c
Symantec	ML.Attribute.HighConfidence
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan.Win64.Agent.gen
Rising	Trojan.Agent!8.B1E (CLOUD)
F-Secure	Trojan.TR/Agent.pzcmj
McAfeeD	ti!C9C2671D59E7
Sophos	Generic Reputation PUA (PUA)
Google	Detected
Avira	TR/Agent.pzcmj
Kingsoft	Win64.Trojan.Agent.gen
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Trojan.Win64.Agent.gen
AhnLab-V3	Trojan/Win.Acll.C5621813
DeepInstinct	MALICIOUS
Ikarus	Trojan.Win32.Generic
Panda	Trj/Chgt.AD
huorong	HEUR:TrojanSpy/Stealer.am
Fortinet	W64/Kryptik.EMS!tr
AVG	Win64:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

Authenticator222.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All