popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Twitch x Loot Lab Event - 2025.msc

Antivirus KeyLogger ScreenShot AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 9, 2024, 9:54 a.m. Sept. 9, 2024, 9:56 a.m.
Size 142.0KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 41c656c497d7ec24de57a9927c13e81c
SHA256 5042f64c0c5b1325964279106f0afa330fb2810416043784f5b4deeef0e93aa4
CRC32 F236EE11
ssdeep 384:PLUWHwIvDfCbiiNPyVIB7nstz5R0iXV5qf:PDHfD6iiNPydzRJTqf
Yara
  • Antivirus - Contains references to security software

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2756
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000028f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff90000
process_handle: 0xffffffffffffffff
1 0 0
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Run a KeyLogger rule KeyLogger
Process injection Process 2560 resumed a thread in remote process 2672
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000280
suspend_count: 1
process_identifier: 2672
1 0 0
Lionic Trojan.Script.Dump.4!c
ALYac Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
VIPRE Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Arcabit Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
VirIT Trojan.MSC.Heur.A
ESET-NOD32 XML/TrojanDownloader.Agent.AD
Avast Other:Malware-gen [Trj]
Kaspersky HEUR:Trojan.Script.MSC.gen
BitDefender Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
MicroWorld-eScan Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Emsisoft Dump:Generic.MSC.Kimsuky.A.FFFFFFFE (B)
FireEye Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Ikarus Trojan-Downloader.XML.Agent
Google Detected
MAX malware (ai score=88)
Kingsoft Script.Trojan.MSC.gen
ZoneAlarm HEUR:Trojan.Script.MSC.gen
GData Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Varist ABApplication.JND
Tencent Win32.Trojan-Downloader.Der.Qwhl
AVG Other:Malware-gen [Trj]
alibabacloud Trojan[downloader]:Multi/MSC.gyf