Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 17, 2024, 1:34 p.m.	Sept. 17, 2024, 2:25 p.m.

Size	2.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bee899073ade70f17b353c7f1f9e2748`
SHA256	`3abd01f8fa4bbc0919e070295b6c8a1ac511fdc136e992badf65b461a92f5074`
CRC32	`A0EB090E`
ssdeep	`49152:dgokKNDK7VHKrv7OkRHWv38rYlyH6uwp7rw6Yv/t7ku2OSdi/a9w7SbryRJ3SFxw:SUNu7VqXO+7sU7kuz`
PDB Path	C:\vmagent_new\bin\joblist\683178\out\Release\360PrivacyGuard.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Antivirus - Contains references to security software Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

66df1acad4359_res_out.exe "C:\Users\test22\AppData\Local\Temp\66df1acad4359_res_out.exe"
1516

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
5.181.86.244	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49163 -> 5.181.86.244:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 5.181.86.244:80 -> 192.168.56.103:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 5.181.86.244:80 -> 192.168.56.103:49163	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 5.181.86.244:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

C:\vmagent_new\bin\joblist\683178\out\Release\360PrivacyGuard.pdb

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://5.181.86.244/aXfj40bOe4/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.181.86.244/aXfj40bOe4/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.181.86.244/aXfj40bOe4/Plugins/clip64.dll

Performs some HTTP requests (3 events)

request	POST http://5.181.86.244/aXfj40bOe4/index.php
request	GET http://5.181.86.244/aXfj40bOe4/Plugins/cred64.dll
request	GET http://5.181.86.244/aXfj40bOe4/Plugins/clip64.dll

Sends data using the HTTP POST Method (1 event)

request

POST http://5.181.86.244/aXfj40bOe4/index.php

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 98304 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 61440 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00575000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 region_size: 100003840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 49152 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00583000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 208896 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 184320 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 438272 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 196608 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 167936 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 1516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 438272 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f4000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\Pictures\USBAgent\USBAgent.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00104800', u'virtual_address': u'0x000f4000', u'entropy': 7.218557395010501, u'name': u'.rsrc', u'virtual_size': u'0x00104708'}

entropy

7.21855739501

description

A section with a high entropy has been found

entropy

0.508664876739

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 90548b75cd904e9a0f9fe9c93de895ed5959c598

Communicates with host for which no DNS query was performed (1 event)

host

5.181.86.244

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 2288 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000ec	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UsbAgentSoftware

reg_value

C:\Users\test22\Pictures\USBAgent\USBAgent.exe

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1516 manipulating memory of non-child process 2288
NtAllocateVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 2288 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000ec	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1516 injected into non-child 2288
WriteProcessMemory Sept. 17, 2024, 1:35 p.m.	buffer: base_address: 0x7efde008 process_identifier: 2288 process_handle: 0x000000ec	1	1	0

Executed a process and injected code into it, probably while unpacking (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 17, 2024, 1:35 p.m.	thread_identifier: 2292 thread_handle: 0x000000e8 process_identifier: 2288 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66df1acad4359_res_out.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66df1acad4359_res_out.exe stack_pivoted: 0 creation_flags: 2 (DEBUG_ONLY_THIS_PROCESS) inherit_handles: 0 process_handle: 0x000000ec	1	1
NtGetContextThread Sept. 17, 2024, 1:35 p.m.	thread_handle: 0x000000e8	1	0
NtAllocateVirtualMemory Sept. 17, 2024, 1:35 p.m.	process_identifier: 2288 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000ec	1	0
WriteProcessMemory Sept. 17, 2024, 1:35 p.m.	buffer: base_address: 0x001e0000 process_identifier: 2288 process_handle: 0x000000ec	1	1
WriteProcessMemory Sept. 17, 2024, 1:35 p.m.	buffer: base_address: 0x7efde008 process_identifier: 2288 process_handle: 0x000000ec	1	1

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Loader.4!c
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.74135945
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74135945
Sangfor	Trojan.Win32.Loader.Vk5w
BitDefender	Trojan.GenericKD.74135945
K7GW	Trojan ( 005ba4331 )
K7AntiVirus	Trojan ( 005ba4331 )
Arcabit	Trojan.Generic.D46B3989
VirIT	Trojan.Win32.VBGenus.HHB
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.GCMQCGB
Avast	Win32:Evo-gen [Trj]
Kaspersky	Trojan.Win32.Loader.ldy
Alibaba	Trojan:Win32/Loader.98475049
NANO-Antivirus	Virus.Win32.Gen.ccmw
MicroWorld-eScan	Trojan.GenericKD.74135945
Rising	Trojan.Injector!1.FCCE (CLASSIC)
Emsisoft	Trojan.GenericKD.74135945 (B)
TrendMicro	Trojan.Win32.AMADEY.YXEIMZ
McAfeeD	ti!3ABD01F8FA4B
CTX	exe.trojan.loader
Sophos	Troj/Mdrop-JYD
Ikarus	Trojan.Win32.Krypt
FireEye	Trojan.GenericKD.74135945
Webroot	W32.Trojan.GenKD
Google	Detected
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	Trojan.Win32.Loader.ldy
GData	Trojan.GenericKD.74135945
Varist	W32/ABTrojan.BYEN-6946
McAfee	Artemis!BEE899073ADE
DeepInstinct	MALICIOUS
VBA32	Trojan.Loader
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEIMZ
Tencent	Malware.Win32.Gencirc.1419b46c
MaxSecure	Trojan.Malware.279249676.susgen
Fortinet	W32/Malicious_Behavior.SBX
AVG	Win32:Evo-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan:Win/Loader.lbk

66df1acad4359_res_out.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All