popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PI No.1070034483.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 23, 2024, 11:03 a.m. Sept. 23, 2024, 11:05 a.m.
Size 1.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5724752f0760c7698b2a4fd2c0d6ed8f
SHA256 8c0bef32495b11449416c3eac359d91ebad3df3e4ab16dcc57119afe882b81e3
CRC32 63E567AC
ssdeep 24576:uRmJkcoQricOIQxiZY1iaC/kMbvSzsUa+QUUJOZ3v9M3j9f3d8r8nph:7JZoQrbTFZY1iaC/ks+jUkZCz9P24nb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 16384
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2668
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2668
region_size: 151552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2672
thread_handle: 0x000001a0
process_identifier: 2668
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\PI No.1070034483.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000001a4
1 1 0
Process injection Process 2668 manipulating memory of non-child process 988
Time & API Arguments Status Return Repeated

NtMapViewOfSection

 section_handle: 0x0000004c
process_identifier: 988
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x04250000
allocation_type: 0 ()
section_offset: 0
view_size: 12472320
process_handle: 0x00000050
1 0 0
Process injection Process 2560 called NtSetContextThread to modify thread in remote process 2668
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2031304
registers.edi: 0
registers.eax: 4199888
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001a0
process_identifier: 2668
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Autoit.4!c
tehtris Generic.Malware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Dropper.tc
Cylance Unsafe
VIPRE Trojan.GenericKD.74168320
Sangfor Trojan.Win32.Autoit.Vyy4
CrowdStrike win/malicious_confidence_90% (D)
BitDefender Trojan.GenericKD.74168320
K7GW Trojan ( 700000111 )
K7AntiVirus Trojan ( 700000111 )
Arcabit Trojan.Generic.D46BB800
Symantec Trojan.Gen.2
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.Autoit.GKF
APEX Malicious
Avast Script:SNH-gen [Trj]
Alibaba TrojanSpy:Win32/Autoitinject.e7389757
MicroWorld-eScan Trojan.GenericKD.74168320
Rising Trojan.Injector/Autoit!1.10326 (CLASSIC)
Emsisoft Trojan.GenericKD.74168320 (B)
F-Secure Trojan.TR/AD.Swotter.bkspv
TrendMicro Cryp_Embed4
McAfeeD ti!8C0BEF32495B
Trapmine suspicious.low.ml.score
CTX exe.trojan.autoit
Sophos Mal/Generic-S
FireEye Generic.mg.5724752f0760c769
Google Detected
Avira TR/AD.Swotter.bkspv
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Trojan:Win32/Leonem
GData Trojan.GenericKD.74168320
Varist W32/AutoIt.AQ.gen!Eldorado
AhnLab-V3 Trojan/Win.Agent.C5672220
McAfee Artemis!5724752F0760
DeepInstinct MALICIOUS
VBA32 Trojan.Autoit.F
Malwarebytes Generic.Malware/Suspicious
Ikarus Trojan.Win32.Injector
Panda Trj/CI.A
TrendMicro-HouseCall Cryp_Embed4
Tencent Win32.Trojan.Malware.Swhl
Yandex Trojan.Igent.b21Tzc.6
MaxSecure Trojan.Autoit.AZA
Fortinet AutoIt/Phishing.0644!tr
AVG Script:SNH-gen [Trj]
Paloalto generic.ml