Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 17, 2024, 1:17 p.m.	Sept. 17, 2024, 1:20 p.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a1b876e3a538a90e720d9b2ba7fbfd71`
SHA256	`aa2cae824c23fc15f2ef9fd64e369a78d49f1a068737a01c7697bae442971410`
CRC32	`AAA2AE0B`
ssdeep	`24576:987Ezl5WChST3zxyDR0KUewtUQ398MmYSWD/58zLEeJthK2r/xYEisxMr4/6zLiU:G4l5WChSTfKUeaFyhthD/Lj5`
PDB Path	C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\otr.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

66e4638fb0392_otrrac.exe#kisotrrac "C:\Users\test22\AppData\Local\Temp\66e4638fb0392_otrrac.exe#kisotrrac"
2032
- MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2144

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
192.153.57.177	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2024, 1:17 p.m.			0	0
IsDebuggerPresent Sept. 17, 2024, 1:17 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\otr.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2024, 1:17 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (27 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00afe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0017dc00', u'virtual_address': u'0x00002000', u'entropy': 7.709872115503676, u'name': u'.text', u'virtual_size': u'0x0017da30'}

entropy

7.7098721155

description

A section with a high entropy has been found

entropy

0.923495615361

description

Overall entropy of this PE file is high

Yara rule detected in process memory (13 events)

description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications over HTTP	rule	Network_HTTP
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

Communicates with host for which no DNS query was performed (1 event)

host

192.153.57.177

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2144 region_size: 90112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $~*Á :K¯ó:K¯ó:K¯óq3«ò8K¯óq3©ò;K¯óq3®ò=K¯ó:K®ó-K¯ó.4¦ò/K¯ó.4ò;K¯óRich:K¯óPEL@Ãgeà$þDÜ@`JP`I8p.text²üþ `.rdataô<>@@.dataüP@@À base_address: 0x00400000 process_identifier: 2144 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: s base_address: 0x00415000 process_identifier: 2144 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2144 process_handle: 0x00000240	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $~*Á :K¯ó:K¯ó:K¯óq3«ò8K¯óq3©ò;K¯óq3®ò=K¯ó:K®ó-K¯ó.4¦ò/K¯ó.4ò;K¯óRich:K¯óPEL@Ãgeà$þDÜ@`JP`I8p.text²üþ `.rdataô<>@@.dataüP@@À base_address: 0x00400000 process_identifier: 2144 process_handle: 0x00000240	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2032 called NtSetContextThread to modify thread in remote process 2144
NtSetContextThread Sept. 17, 2024, 1:17 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4233948 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000220 process_identifier: 2144	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2032 resumed a thread in remote process 2144
NtResumeThread Sept. 17, 2024, 1:17 p.m.	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 2144	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.153.57.177:80

Executed a process and injected code into it, probably while unpacking (13 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 17, 2024, 1:17 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2032	1	0
NtResumeThread Sept. 17, 2024, 1:17 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2032	1	0
NtResumeThread Sept. 17, 2024, 1:17 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2032	1	0
CreateProcessInternalW Sept. 17, 2024, 1:17 p.m.	thread_identifier: 2148 thread_handle: 0x00000220 process_identifier: 2144 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread Sept. 17, 2024, 1:17 p.m.	thread_handle: 0x00000220	1	0
NtAllocateVirtualMemory Sept. 17, 2024, 1:17 p.m.	process_identifier: 2144 region_size: 90112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: MZÿÿ¸@Ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $~*Á :K¯ó:K¯ó:K¯óq3«ò8K¯óq3©ò;K¯óq3®ò=K¯ó:K®ó-K¯ó.4¦ò/K¯ó.4ò;K¯óRich:K¯óPEL@Ãgeà$þDÜ@`JP`I8p.text²üþ `.rdataô<>@@.dataüP@@À base_address: 0x00400000 process_identifier: 2144 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: base_address: 0x00401000 process_identifier: 2144 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: base_address: 0x00411000 process_identifier: 2144 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: s base_address: 0x00415000 process_identifier: 2144 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 17, 2024, 1:17 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2144 process_handle: 0x00000240	1	1
NtSetContextThread Sept. 17, 2024, 1:17 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4233948 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000220 process_identifier: 2144	1	0
NtResumeThread Sept. 17, 2024, 1:17 p.m.	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 2144	1	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stealerc.1m!c
CAT-QuickHeal	Trojanpws.Msil
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Jalapeno.18321
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.18321
Sangfor	Infostealer.Msil.Kryptik.Vpyx
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Variant.Jalapeno.18321
K7GW	Trojan ( 005b637f1 )
K7AntiVirus	Trojan ( 005b637f1 )
Arcabit	Trojan.Jalapeno.D4791
VirIT	Trojan.Win32.GenusT.DZII
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.ALRL
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealerc.gen
Alibaba	TrojanPSW:MSIL/Stealerc.26f42354
MicroWorld-eScan	Gen:Variant.Jalapeno.18321
Rising	Malware.Obfus/MSIL@AI.94 (RDM.MSIL2:RAa/y2o0dG1dOifARke23Q)
Emsisoft	Gen:Variant.Jalapeno.18321 (B)
F-Secure	Trojan.TR/AD.RaccoonSteal.ipwvb
TrendMicro	TrojanSpy.Win32.RACCOONSTEALER.YXEIOZ
McAfeeD	ti!AA2CAE824C23
CTX	exe.trojan.msil
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.a1b876e3a538a90e
Google	Detected
Avira	TR/AD.RaccoonSteal.ipwvb
Kingsoft	MSIL.Trojan-PSW.Stealerc.gen
Gridinsoft	Spy.Win32.Raccoon.tr
Microsoft	Trojan:MSIL/RecordBreaker.RDM!MTB
ViRobot	Trojan.Win.Z.Kryptik.1693696
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealerc.gen
GData	Gen:Variant.Jalapeno.18321
Varist	W32/ABTrojan.CWTH-5738
AhnLab-V3	Trojan/Win.Generic.C5660581
McAfee	Artemis!A1B876E3A538
DeepInstinct	MALICIOUS
Ikarus	Trojan.MSIL.Crypt
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.RACCOONSTEALER.YXEIOZ
Tencent	Msil.Trojan-QQPass.QQRob.Rimw
huorong	TrojanSpy/MSIL.Stealer.fw
Fortinet	MSIL/Kryptik.ALRR!tr
AVG	Win32:PWSX-gen [Trj]

66e4638fb0392_otrrac.exe#kisotrrac

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All