Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 16, 2024, 3:13 p.m.	Aug. 16, 2024, 3:15 p.m.

Size	223.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d72fea64a05b3f7dce725352d7c1d032`
SHA256	`8fdae5b4490183c9057a684f0ac2f82dd5c8911cb2f43a54ff47a9ad6e93952a`
CRC32	`8226C460`
ssdeep	`6144:wguKV5BwUnZqazMhD9RLJt88sndcP8pPyDvUGOks:kKLBwiZlzMB9xgndcP88DvvP`
PDB Path	A:\Code\GitHub\r77-rootkit\vs\InstallStager\obj\Release\InstallStager.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Is_DotNET_EXE - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

rootkit.dll "C:\Users\test22\AppData\Local\Temp\rootkit.dll"
2540

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 16, 2024, 3:13 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

A:\Code\GitHub\r77-rootkit\vs\InstallStager\obj\Release\InstallStager.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 16, 2024, 3:13 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a31000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3caf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cae000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00053000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0011d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0005c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00054000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0006f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00055000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 16, 2024, 3:13 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1052672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d31000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00037200', u'virtual_address': u'0x00002000', u'entropy': 7.973598621927838, u'name': u'.text', u'virtual_size': u'0x00037050'}

entropy

7.97359862193

description

A section with a high entropy has been found

entropy

0.991011235955

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 16, 2024, 3:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 16, 2024, 3:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.DiscordStealer.4!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.dc
ALYac	Generic.Trojan.DiscordStealer.B.FC2A3329
Cylance	Unsafe
VIPRE	Generic.Trojan.DiscordStealer.B.FC2A3329
Sangfor	Trojan.Msil.Injector.Vgfu
K7AntiVirus	Trojan ( 00581f931 )
BitDefender	Generic.Trojan.DiscordStealer.B.FC2A3329
K7GW	Trojan ( 00581f931 )
Cybereason	malicious.4a05b3
Arcabit	Generic.Trojan.DiscordStealer.B.FC2A3329
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.VOF
APEX	Malicious
McAfee	RDN/Generic.hbg
Avast	Win32:InjectorX-gen [Trj]
ClamAV	Win.Packed.Lazy-10019086-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:MSIL/Injector.d8d9eb23
MicroWorld-eScan	Generic.Trojan.DiscordStealer.B.FC2A3329
Rising	Malware.Obfus/MSIL@AI.84 (RDM.MSIL2:3yr0n438cjqeZnXGMo/8vg)
Emsisoft	Generic.Trojan.DiscordStealer.B.FC2A3329 (B)
F-Secure	Trojan.TR/Dropper.MSIL.Gen
DrWeb	Trojan.Inject4.17628
Zillya	Trojan.Injector.Win32.1167409
TrendMicro	TROJ_GEN.R002C0DDE24
McAfeeD	ti!8FDAE5B44901
FireEye	Generic.mg.d72fea64a05b3f7d
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Generic.hgxkc
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Dropper.MSIL.Gen
MAX	malware (ai score=87)
Antiy-AVL	Trojan/MSIL.Inject
Kingsoft	Win32.Trojan.Generic.a
Gridinsoft	Ransom.Win32.Bladabindi.oa!s1
Xcitium	Malware@#1p0c3fcqzuqnx
Microsoft	Trojan:MSIL/Zusy.KA!MTB
ViRobot	Trojan.Win32.Z.Injector.228352.CF
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Generic.Trojan.DiscordStealer.B.FC2A3329
Varist	W32/ABRisk.QJEY-1153
AhnLab-V3	Trojan/Win.Generic.C4512391
BitDefenderTheta	Gen:NN.ZemsilF.36810.nm0@aeovOxn
DeepInstinct	MALICIOUS

rootkit.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All