Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 2, 2024, 10:12 a.m.	Sept. 2, 2024, 10:31 a.m.

Size	426.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`eafad63994d7226e68bb54d7a9396e91`
SHA256	`ad2315d49459ab240df61af4f6e336f310c470ec33f8bec1cb8d4fb16b48ae9d`
CRC32	`E57A7038`
ssdeep	`3072:bAa0zeTpio4F+B1MFnMUE2XAVLis8sIQaaBbnkuKMdcKQsd7WyxM1J0C1HzKyL:lTpq+w1MzaAVJ51LKMjpWy2J0oKyL`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description)

US+ONLY1.exe "C:\Users\test22\AppData\Local\Temp\US+ONLY1.exe"
2624

Name	Response	Post-Analysis Lookup
i.ibb.co	A 172.96.160.210 A 172.96.161.6 A 104.194.8.120 A 172.96.160.183 A 172.96.160.168	172.96.160.168

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.96.160.210	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49161 -> 172.96.160.210:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 2, 2024, 10:12 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:12 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 2, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005206d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00520650 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00520650 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 2, 2024, 10:12 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7341b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7334a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7395f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd01000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fc31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fbd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fb81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fb71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73111000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fad1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75831000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2624 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 2, 2024, 10:12 a.m.	flags: 1158 family: 0	1	0	0

A process attempted to delay the analysis task. (1 event)

description

US+ONLY1.exe tried to sleep 2728263 seconds, actually delayed analysis time by 2728263 seconds

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Crysan.m!c
Elastic	malicious (high confidence)
CAT-QuickHeal	Backdoor.MSIL
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.73974803
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73974803
Sangfor	Downloader.Msil.Crysan.Vjzz
K7AntiVirus	Trojan-Downloader ( 005b9bfc1 )
BitDefender	Trojan.GenericKD.73974803
K7GW	Trojan-Downloader ( 005b9bfc1 )
Arcabit	Trojan.Generic.D468C413
Symantec	Downloader
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.RDT
McAfee	Artemis!EAFAD63994D7
Avast	Win32:BackdoorX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
Alibaba	Backdoor:MSIL/Crysan.49ad614b
MicroWorld-eScan	Trojan.GenericKD.73974803
Rising	Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:jgB1lYFSn9lv2JXH6qtRlQ)
Emsisoft	Trojan.GenericKD.73974803 (B)
F-Secure	Trojan.TR/Dldr.Agent.mxibt
DrWeb	Trojan.DownLoaderNET.1015
TrendMicro	Trojan.Win32.AMADEY.YXEH2Z
McAfeeD	ti!AD2315D49459
FireEye	Generic.mg.eafad63994d7226e
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.AMADEY.YXEH2Z
Google	Detected
Avira	TR/Dldr.Agent.mxibt
MAX	malware (ai score=85)
Kingsoft	MSIL.Backdoor.Crysan.gen
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Casdet!rfn
ViRobot	Trojan.Win.Z.Agent.436736.BN
ZoneAlarm	HEUR:Backdoor.MSIL.Crysan.gen
GData	Trojan.GenericKD.73974803
Varist	W32/ABRisk.LYYQ-5839
AhnLab-V3	Trojan/Win.Generic.C5662563
BitDefenderTheta	Gen:NN.ZemsilF.36812.Am0@aeoGjkni
DeepInstinct	MALICIOUS
VBA32	Downloader.MSIL.gen.rexp
Malwarebytes	Backdoor.AsyncRAT
Ikarus	Trojan-Downloader.MSIL.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEH2Z
Tencent	Malware.Win32.Gencirc.141833e5

US+ONLY1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All