Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 26, 2024, 9:28 a.m.	Aug. 26, 2024, 9:31 a.m.

Size	924.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`de64bb0f39113e48a8499d3401461cf8`
SHA256	`64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a`
CRC32	`CBC8DCFE`
ssdeep	`24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description)

Mswgoudnv.exe "C:\Users\test22\AppData\Local\Temp\Mswgoudnv.exe"
772

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 26, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 26, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 26, 2024, 9:28 a.m.			0	0
IsDebuggerPresent Aug. 26, 2024, 9:28 a.m.			0	0
IsDebuggerPresent Aug. 26, 2024, 9:28 a.m.			0	0
IsDebuggerPresent Aug. 26, 2024, 9:28 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 26, 2024, 9:28 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02100000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00791000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0038a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00792000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00793000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00794000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 26, 2024, 9:28 a.m.	process_identifier: 772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000e6800', u'virtual_address': u'0x00002000', u'entropy': 7.97374318147572, u'name': u'.text', u'virtual_size': u'0x000e6604'}

entropy

7.97374318148

description

A section with a high entropy has been found

entropy

0.997835497835

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 4861c36179c66f19b97ad84396f59d2185247904

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Remcos.m!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.dc
ALYac	Trojan.GenericKD.73883945
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73883945
Sangfor	Backdoor.Msil.Kryptik.V9ev
BitDefender	Trojan.GenericKD.73883945
Arcabit	Trojan.Generic.D4676129
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.RDM
APEX	Malicious
McAfee	Artemis!DE64BB0F3911
Avast	Win32:CrypterX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
Alibaba	Backdoor:MSIL/Remcos.c010913b
MicroWorld-eScan	Trojan.GenericKD.73883945
Rising	Backdoor.Coroxy!8.12282 (CLOUD)
Emsisoft	Trojan.GenericKD.73883945 (B)
F-Secure	Trojan.TR/Kryptik.vgmyo
TrendMicro	Trojan.Win32.AMADEY.YXEHVZ
McAfeeD	Real Protect-LS!DE64BB0F3911
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.de64bb0f39113e48
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/Kryptik.vgmyo
MAX	malware (ai score=82)
Antiy-AVL	Trojan/MSIL.Kryptik
Kingsoft	MSIL.Backdoor.Remcos.gen
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Backdoor:Win32/Coroxy.E
ZoneAlarm	HEUR:Backdoor.MSIL.Remcos.gen
GData	Trojan.GenericKD.73883945
Varist	W32/MSIL_Kryptik.JZK.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5661093
BitDefenderTheta	Gen:NN.ZemsilF.36812.5m0@ayIBL@p
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL.Generic
Ikarus	Trojan.MSIL.Inject
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEHVZ
Tencent	Malware.Win32.Gencirc.14174865
huorong	HEUR:TrojanDownloader/MSIL.Seraph.e
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GZBT!tr
AVG	Win32:CrypterX-gen [Trj]

Mswgoudnv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All