Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 6, 2024, 2:28 p.m.	Sept. 6, 2024, 2:30 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cf43fda6634d7674690c8eaf6c348816`
SHA256	`4d922291ea495a402edbef0afb64e7f5fd760c0eb718e4fcf83cdb9f4370a8cc`
CRC32	`A3A7E90D`
ssdeep	`24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa4difRHtncFnEoXVcnhk7gi2T55:eh+ZkldoPK8Ya40HtjoXVcsx2/`
Yara	Process_Snapshot_Kill_Zero - Process Kill Zero Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature FindFirstVolume_Zero - FindFirstVolume Zero CryptGenKey_Zero - CryptGenKey Zero Device_Check_Zero - Device Check Zero IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

MeMpEng.exe "C:\Users\test22\AppData\Local\Temp\MeMpEng.exe"
2556
- svchost.exe "C:\Users\test22\AppData\Local\Temp\MeMpEng.exe"
  2656
odbcconf.exe "C:\Windows\SysWOW64\odbcconf.exe"
2740
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  3004
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
www.onlytradez.club	A 167.172.133.32	167.172.133.32
www.d71dg.top	A 154.23.184.60 CNAME d71dg.top	154.23.184.60
www.2886080.xyz	A 103.249.106.91	103.249.106.91
www.zenzip.xyz	A 203.161.46.201	203.161.46.201
www.sgcwin77rtplive.fun
www.32wxd.top	CNAME 32wxd.top A 206.119.82.116	206.119.82.116
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.inmotarget.online	A 98.124.224.17
www.51cc.top	A 216.83.36.195	216.83.36.195
www.foundation-repair.biz	A 199.59.243.226	199.59.243.226
www.kej-sii.cloud
www.meetfactory.biz	A 96.126.123.244 A 198.58.118.167 A 45.33.30.197 A 45.33.23.183 A 45.79.19.196 A 72.14.185.43 A 72.14.178.174 A 45.33.2.79 A 45.56.79.23 A 45.33.20.235 A 45.33.18.44 A 173.255.194.134	72.14.185.43

IP Address	Status	Action
103.249.106.91	Active	Moloch
154.23.184.60	Active	Moloch
164.124.101.2	Active	Moloch
167.172.133.32	Active	Moloch
198.58.118.167	Active	Moloch
199.59.243.226	Active	Moloch
203.161.46.201	Active	Moloch
206.119.82.116	Active	Moloch
216.83.36.195	Active	Moloch
45.33.6.223	Active	Moloch
98.124.224.17	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49187 -> 206.119.82.116:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 103.249.106.91:80 -> 192.168.56.101:49168	2036300	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1	Misc activity
TCP 103.249.106.91:80 -> 192.168.56.101:49168	2036301	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2	Misc activity
TCP 103.249.106.91:80 -> 192.168.56.101:49168	2036302	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3	Misc activity
UDP 192.168.56.101:61950 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
UDP 192.168.56.101:52815 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
UDP 192.168.56.101:52753 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
UDP 192.168.56.101:55146 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 6, 2024, 2:28 p.m.			0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (19 events)

request	POST http://www.2886080.xyz/eyiz/
request	GET http://www.2886080.xyz/eyiz/?skJ-Lus=XQ7d8vWNf2bTOhYYL6UJlqYAXy7Rg8V7tb7nan5iZXoOR23qJ7xYi6zjP0ZZPC1qNGRbW38doA+CklQhfBW16OH9GbU74opfrouVpsjlwzkQhOIIL+clvr6SJ5uB6xxabU5X5cQ=&pvx3S=Xzx0sFPmCssrV
request	GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3290000.zip
request	POST http://www.foundation-repair.biz/5l7s/
request	GET http://www.foundation-repair.biz/5l7s/?skJ-Lus=5i9IxHyDCONgw46qIHGeUvwlYzbtgN8gQUqUIjK6jcHsfbLgiJ2s3wDRXgbc+h/bICwzf3ddx8E1HmjHsyEg1i4ki39GGAPq3qClCRMeu9QIBTg/A11C17kmPPIEN81gm2sAq9Q=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.51cc.top/7i54/
request	GET http://www.51cc.top/7i54/?skJ-Lus=SgV//QM+kZDZSmca7ISHR4U/9iG4TLn30ssUgf4MDLRPguhpDtuGIpE5eby1mFBEyx9n6ho2rfFD9SDq3nlePS+8rBqg/0cGFsBGWXu5QF07X9CUnUPZux9wfWAAZevyIeAs5Qc=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.zenzip.xyz/9pad/
request	GET http://www.zenzip.xyz/9pad/?skJ-Lus=1a5ATRlanZ3ATSTMsvfkUs0ciM8umoJS8y8kT4HdOCMJyW9sS8tB9dhHCXeYKtsB5QysC2Hg2jCPifAM2S09CoHR88nq9oCTqozYG6NauxPM4LjmZuBJG1m7wEgFKI64QDVX+78=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.meetfactory.biz/xoqw/
request	GET http://www.meetfactory.biz/xoqw/?skJ-Lus=IHXCkUsJunCVOO2Hwv8L1/jebUXenMysZsXgVBD8KQgj+TIAwNGDK5EWhUbKXzAU4KMQODjr0cxiOqiC8Z91HBWngaVBBi9zW0XdtSpa8XSCv8AOb3sJWenXQ9ufn4pifwUOwgs=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.onlytradez.club/k1y3/
request	GET http://www.onlytradez.club/k1y3/?skJ-Lus=J7VJwuuG4HUA4bFTkbQEdxkpMEpXPBCRRs+F1x6QwwkcPlqAPKpQJUUQrtsDqb7Q+tjdIUGQwp4fGorxq2J//mB+PqSTwbyLcRM9dR0EDrcHS/LNmgUR990rINKp1m+e5VNnNrk=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.32wxd.top/fqtd/
request	GET http://www.32wxd.top/fqtd/?skJ-Lus=NOGaE4zNJ3vPzwJVq9flFF94in2IcnN0bsRklEYFuNltL64f812fYl1xoipxw6mqFzyE6nPBnWGndAD5Tl5FPYyUit02KiWxxW2zK2p9R7C5MnzH/2vAyX3OoZI/vgfMfT+cSXI=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.d71dg.top/qbiu/
request	GET http://www.d71dg.top/qbiu/?skJ-Lus=cpFY4442L+Bmta8QONEKHiouDvWOZNVLDBDtb0iNjVMT9Lz9+WHyspHM09lzzQ6O3A+WaZO+gSWm6Q36us29ksmtCzg/K1sgttxXiQs+/4tLnxfFR1YWTQNZTBuvIfutPAZp0QU=&pvx3S=Xzx0sFPmCssrV
request	POST http://www.inmotarget.online/f94d/
request	GET http://www.inmotarget.online/f94d/?skJ-Lus=qXxH1TkJqyQLN7K67UolPOrNVrH3EkVnBHKOJBevZlWzyIWqOcopXSkjMgAVQAiVcEwXsA2AXYdRBAjRF8/XmlFRLYiZtr82nLJKSk2mfCIs3NsTyuUwAMniQ4mBWHwlcbK0rUc=&pvx3S=Xzx0sFPmCssrV

Sends data using the HTTP POST Method (9 events)

request	POST http://www.2886080.xyz/eyiz/
request	POST http://www.foundation-repair.biz/5l7s/
request	POST http://www.51cc.top/7i54/
request	POST http://www.zenzip.xyz/9pad/
request	POST http://www.meetfactory.biz/xoqw/
request	POST http://www.onlytradez.club/k1y3/
request	POST http://www.32wxd.top/fqtd/
request	POST http://www.d71dg.top/qbiu/
request	POST http://www.inmotarget.online/f94d/

Resolves a suspicious Top Level Domain (TLD) (3 events)

domain	www.d71dg.top	description	Generic top level domain TLD
domain	www.51cc.top	description	Generic top level domain TLD
domain	www.32wxd.top	description	Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2556 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02670000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2656 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73271000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 6, 2024, 2:28 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x61eb2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 6, 2024, 2:22 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

odbcconf.exe tried to sleep 162 seconds, actually delayed analysis time by 162 seconds

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00058e00', u'virtual_address': u'0x000c8000', u'entropy': 7.889716833457919, u'name': u'.rsrc', u'virtual_size': u'0x00058cb0'}

entropy

7.88971683346

description

A section with a high entropy has been found

entropy

0.305412371134

description

Overall entropy of this PE file is high

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Sept. 6, 2024, 2:28 p.m.	thread_identifier: 2660 thread_handle: 0x0000014c process_identifier: 2656 current_directory: filepath: C:\Windows\System32\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\MeMpEng.exe" filepath_r: C:\Windows\System32\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000150	1	1	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.AgentSM.S6640043
Skyhigh	BehavesLike.Win32.TrojanAitInject.tc
Cylance	Unsafe
VirIT	Trojan.Win32.AutoIt_Heur.A
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Sophos	ML/PE-A
Google	Detected
Kingsoft	malware.kb.a.891
Microsoft	Trojan:Win32/Phonzy.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Varist	W32/Autoit.G.gen!Eldorado
VBA32	Trojan.Autoit.Shellcrun
Malwarebytes	Backdoor.NetWiredRC.AutoIt.Generic
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	AutoIt/Injector.GHD!tr

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2556 called NtSetContextThread to modify thread in remote process 2656
NtSetContextThread Sept. 6, 2024, 2:28 p.m.	registers.eip: 1995571652 registers.esp: 2030832 registers.edi: 0 registers.eax: 4199552 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000014c process_identifier: 2656	1	0	0

MeMpEng.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All