Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 15, 2024, 11:06 a.m.	Aug. 15, 2024, 11:09 a.m.

Size	46.5KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`b43e3cb0e1e8afd9f97b7471d3a15652`
SHA256	`9c9fd30f71a39829fc250a49a38cd55d112d2fe2a11cec5a64ccb30ff29f73a2`
CRC32	`4042A1AA`
ssdeep	`768:rvMhIV8gLaimkrcmK7NmDbG39sjZQlNmrD3k2mwYidZz/zw7N:r3ZL9mkQmKwnG3yjZQPmrD3kF`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

s.exe "C:\Users\test22\AppData\Local\Temp\s.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
120.79.211.9	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 15, 2024, 10:59 a.m.	computer_name: TEST22-PC	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 15, 2024, 10:59 a.m.	process_identifier: 2548 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000005f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 15, 2024, 10:59 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 15, 2024, 10:59 a.m.	process_identifier: 2548 region_size: 4194304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 15, 2024, 10:59 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 180224 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000027b0000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

120.79.211.9

Network activity contains more than one unique useragent (2 events)

process	s.exe				useragent
process	s.exe				useragent	Microsoft-CryptoAPI/10.0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Bkav	W64.AIDetectMalware
VIPRE	Gen:Heur.Whisperer.1.0000000400
BitDefender	Gen:Heur.Whisperer.1.0000000400
Cybereason	malicious.0e1e8a
Arcabit	Trojan.Whisperer.1.0000000400
ESET-NOD32	a variant of Win64/Kryptik_AGen.LR
APEX	Malicious
ClamAV	Win.Trojan.CobaltStrike-9044898-1
Kaspersky	HEUR:Trojan.Win64.CobaltStrike.gen
MicroWorld-eScan	Gen:Heur.Whisperer.1.0000000400
Emsisoft	Gen:Heur.Whisperer.1.0000000400 (B)
FireEye	Gen:Heur.Whisperer.1.0000000400
Ikarus	Trojan.Win64.Cobaltstrike
Google	Detected
MAX	malware (ai score=86)
Microsoft	Trojan:Win64/CobaltStrike.BL!MTB
ZoneAlarm	HEUR:Trojan.Win64.CobaltStrike.gen
GData	Gen:Heur.Whisperer.1.0000000400
Tencent	Trojan.Win32.CobaltStrike.16001072
CrowdStrike	win/malicious_confidence_100% (D)

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49166 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49171 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49174 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49164 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49162 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49165 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49167 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49175 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49176 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49168 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49179 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49169 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49170 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49177 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49178 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49173 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36
TLSv1 192.168.56.101:49172 120.79.211.9:8919	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	C=CN, ST=CA, L=BeiJing, O=Slack Technologies Inc, OU=DigiCert Inc, CN=www.bilibili.com	83:e4:15:ea:3f:9e:86:7f:a1:3a:e8:00:38:83:74:0a:4d:bb:8d:36

s.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All