Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 17, 2024, 1:17 p.m.	Sept. 17, 2024, 2:11 p.m.

Size	417.5KB
Type	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
MD5	`109d640a259b145be1aebeab0fb2842a`
SHA256	`b8c355789bafdf1eb52afb235a2255ef1da7e813248e02b06a6041e11c354788`
CRC32	`E56E8536`
ssdeep	`6144:FAKlBt9JA2Robx3CYR8StTsy7P4bg9YRIud6PGTP2bvuoHBSyz2c0/pJbD5:VlBt/AKow3StoYeqG62x`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

r.exe "C:\Users\test22\AppData\Local\Temp\r.exe"
2004

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2024, 1:17 p.m.			0	0
IsDebuggerPresent Sept. 17, 2024, 1:17 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2024, 1:17 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (38 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c4b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ebc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ee6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W64.AIDetectMalware.CS
Lionic	Trojan.Win32.Rubeus.4!c
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	Artemis!Trojan
ALYac	Generic.Fochi.MSIL.Hacktool.7.36F310E5
VIPRE	Generic.Fochi.MSIL.Hacktool.7.36F310E5
Sangfor	Riskware.Win32.Rubeus.Vn2l
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Generic.Fochi.MSIL.Hacktool.7.36F310E5
K7GW	Riskware ( 0055f8b11 )
K7AntiVirus	Riskware ( 0055f8b11 )
Arcabit	Generic.Fochi.MSIL.Hacktool.7.36F310E5
VirIT	Trojan.Win64.MSIL_Heur.A
Symantec	Hacktool.Rebeus
Elastic	Windows.Hacktool.Rubeus
ESET-NOD32	a variant of MSIL/Riskware.Rubeus.A
APEX	Malicious
Avast	Win64:HacktoolX-gen [Trj]
ClamAV	Win.Trojan.HackTool_MSIL_Rubeus_1-9805032-0
Kaspersky	HEUR:Trojan.Win32.Ruberoid.a
Alibaba	VirTool:Win32/Kekeo.169bde21
MicroWorld-eScan	Generic.Fochi.MSIL.Hacktool.7.36F310E5
Rising	HackTool.Rubeus!1.CFFD (CLASSIC)
Emsisoft	Generic.Fochi.MSIL.Hacktool.7.36F310E5 (B)
DrWeb	Tool.RubeusNET.1
TrendMicro	HackTool.MSIL.Rubeus64.SM
McAfeeD	ti!B8C355789BAF
CTX	exe.trojan.rubeus
Sophos	ATK/Rubeus-E
Ikarus	Virus.Win32.Kekeo
FireEye	Generic.mg.109d640a259b145b
Webroot	W32.Trojan.Gen
Google	Detected
Antiy-AVL	HackTool[VirTool]/Win32.Kekeo
Kingsoft	Win32.Trojan.Ruberoid.a
Gridinsoft	Hack.Win64.Patcher.sa
Microsoft	VirTool:Win32/Kekeo.A!MTB
ZoneAlarm	HEUR:Trojan.Win32.Ruberoid.a
GData	MSIL.Riskware.Rubeus.A
AhnLab-V3	Trojan/Win.Kekeo.C4775367
McAfee	Artemis!109D640A259B
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/CI.A
Tencent	Win32.Trojan.Ruberoid.Gplw
huorong	HackTool/MSIL.Rubeus.a
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Rubeus
AVG	Win64:HacktoolX-gen [Trj]
Paloalto	generic.ml

r.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All