popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PO-LIST.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 20, 2024, 10:34 a.m. Sept. 20, 2024, 10:36 a.m.
Size 2.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e21b8ab721253a904d148587bb256be4
SHA256 0482038dee8cdc3992533d6d3bfd36123a0efc02809b9c1cb87febef83a3517a
CRC32 0BFBC2C3
ssdeep 49152:6TvC/MTQYxsWR7alUZqvJ+UtB7wxAzbimbJX:KjTQYxsWRpZqvJ+kBGob7bJ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
nzobaku.ddns.net
A 45.138.16.248
45.138.16.248
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
45.138.16.248 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2028675 ET POLICY DNS Query to DynDNS Domain *.ddns .net Potentially Bad Traffic
TCP 192.168.56.102:49164 -> 45.138.16.248:8081 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.102:49164
45.138.16.248:8081 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain nzobaku.ddns.net
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740f2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 16384
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0301f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74302000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 16384
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03070000
process_handle: 0xffffffff
1 0 0
description svchost.exe tried to sleep 344 seconds, actually delayed analysis time by 344 seconds
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs
file C:\Users\test22\AppData\Local\directory\name.exe
file C:\Users\test22\AppData\Local\directory\name.exe
file C:\Users\test22\AppData\Local\directory\name.exe
section {u'size_of_data': u'0x00129600', u'virtual_address': u'0x000d4000', u'entropy': 7.98342214418379, u'name': u'.rsrc', u'virtual_size': u'0x00129434'} entropy 7.98342214418 description A section with a high entropy has been found
entropy 0.581094284319 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1780
thread_handle: 0x00000140
process_identifier: 2104
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\PO-LIST.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000138
1 1 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a2df
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 7209413 0
Process injection Process 2216 called NtSetContextThread to modify thread in remote process 2104
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2001207748
registers.esp: 588892
registers.edi: 0
registers.eax: 4409984
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000140
process_identifier: 2104
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win64.Injects.ts93
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.TrojanAitInject.vc
ALYac AIT:Trojan.Nymeria.6323
Cylance Unsafe
VIPRE AIT:Trojan.Nymeria.6323
Sangfor Trojan.Win32.Autoit.Vgvj
CrowdStrike win/malicious_confidence_70% (D)
BitDefender Trojan.Generic.36766592
K7GW Trojan ( 005ba79e1 )
K7AntiVirus Trojan ( 005ba79e1 )
Arcabit Trojan.Generic.D2310380
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.Autoit.GJP
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Script.Generic
Alibaba Trojan:Win32/Autoitinject.9e6f94a5
MicroWorld-eScan Trojan.Generic.36766592
Rising Trojan.Injector/Autoit!1.10326 (CLASSIC)
Emsisoft Trojan.Generic.36766592 (B)
F-Secure Dropper.DR/AutoIt.Gen8
TrendMicro Backdoor.Win32.REMCOS.YXEIRZ
McAfeeD Real Protect-LS!E21B8AB72125
CTX exe.trojan.autoit
Sophos Mal/Generic-S
FireEye Generic.mg.e21b8ab721253a90
Webroot W32.Trojan.Script
Google Detected
Avira DR/AutoIt.Gen8
Kingsoft Script.Trojan.Generic.a
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Backdoor:MSIL/XWormRAT.PDAJ!MTB
GData Trojan.Generic.36766592
McAfee Artemis!E21B8AB72125
DeepInstinct MALICIOUS
Malwarebytes Spyware.PasswordStealer
Ikarus Trojan.Autoit
Panda Trj/CI.A
TrendMicro-HouseCall Backdoor.Win32.REMCOS.YXEIRZ
Tencent Script.Trojan.Generic.Ozfl
MaxSecure Trojan.Malware.300983.susgen
Fortinet AutoIt/Agent.OM!tr
AVG Win32:Malware-gen
Paloalto generic.ml