Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 15, 2024, 11:05 a.m.	Aug. 15, 2024, 11:11 a.m.

Size	44.0KB
Type	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`299d90fd59dde6708ece0a0f73423997`
SHA256	`da80befcb4b78abaac8632becec8c6ac0d8a3ed57104be2cc2579912ec446cc8`
CRC32	`16090F41`
ssdeep	`768:bj9EaiyURDkkxPt5NmVrSG+et/GWFQrhwEr0dmw9wxNs8U:l9URDkWPteQG++/GwQrhw80qxI`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) DllRegisterServer_Zero - execute regsvr32.exe Generic_Malware_Zero - Generic Malware

a.exe "C:\Users\test22\AppData\Local\Temp\a.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
120.79.211.9	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 15, 2024, 10:58 a.m.	computer_name: TEST22-PC	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 15, 2024, 10:58 a.m.	process_identifier: 2548 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000000c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 15, 2024, 10:58 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 15, 2024, 10:58 a.m.	process_identifier: 2548 region_size: 4194304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000041b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 15, 2024, 10:58 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 180224 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x0000000002530000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

120.79.211.9

Network activity contains more than one unique useragent (2 events)

process	a.exe				useragent
process	a.exe				useragent	Microsoft-CryptoAPI/10.0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W64.AIDetectMalware
Elastic	malicious (high confidence)
VIPRE	Gen:Heur.Whisperer.1.0000000400
BitDefender	Gen:Heur.Whisperer.1.0000000400
Cybereason	malicious.d59dde
Arcabit	Trojan.Whisperer.1.0000000400
APEX	Malicious
ClamAV	Win.Trojan.CobaltStrike-9044898-1
Kaspersky	HEUR:Trojan.Win64.CobaltStrike.gen
MicroWorld-eScan	Gen:Heur.Whisperer.1.0000000400
Emsisoft	Gen:Heur.Whisperer.1.0000000400 (B)
FireEye	Gen:Heur.Whisperer.1.0000000400
SentinelOne	Static AI - Suspicious PE
Google	Detected
MAX	malware (ai score=80)
Microsoft	Trojan:Win64/CobaltStrike.BL!MTB
ZoneAlarm	HEUR:Trojan.Win64.CobaltStrike.gen
GData	Gen:Heur.Whisperer.1.0000000400
Acronis	suspicious
DeepInstinct	MALICIOUS
Ikarus	Trojan.Win64.Cobaltstrike
Tencent	Trojan.Win32.CobaltStrike.16001072
CrowdStrike	win/malicious_confidence_100% (D)

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49162 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49167 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49170 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49168 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49172 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49166 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49169 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49177 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49174 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49171 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49179 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49165 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49173 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49175 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49176 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49178 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36

a.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All