Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 25, 2024, 10:46 a.m.	Sept. 25, 2024, 10:48 a.m.

Size	2.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d1a71a41adffc6131f04ad62bc16866a`
SHA256	`7423aa8ba840f6ca0d746ef6708363f1a75ced682859a9eb26df5d8faabf5854`
CRC32	`67E98A3B`
ssdeep	`49152:XwREDDMKjETTJxiRD+Vw4z0g3QEh1SijB4TPdHeMxWrP+beY7UY714:XwRE1jETTJxiRD+VDzJQEh1Si10PdMwi`
Yara	Malicious_Library_Zero - Malicious_Library Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

InnoPack.exe "C:\Users\test22\AppData\Local\Temp\InnoPack.exe"
2552
- InnoPack.tmp "C:\Users\test22\AppData\Local\Temp\is-TBD47.tmp\InnoPack.tmp" /SL5="$80178,1872046,845824,C:\Users\test22\AppData\Local\Temp\InnoPack.exe"
  2632
  - vucakq.exe "C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\vucakq.exe" C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\script.a3x
    2684
    - GoogleUpdateCore.exe "C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe"
      2748
      - remcos.exe "C:\ProgramData\Remcos\remcos.exe"
        2816

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2024, 10:46 a.m.			0	0
IsDebuggerPresent Sept. 25, 2024, 10:46 a.m.			0	0
IsDebuggerPresent Sept. 25, 2024, 10:46 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2024, 10:46 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 25, 2024, 10:46 a.m.	stacktrace: __dbk_fcall_wrapper+0x287a85 dbkFCallWrapperAddr-0x21fab innopack+0x29969d @ 0xf0969d __dbk_fcall_wrapper+0x287a85 dbkFCallWrapperAddr-0x21fab innopack+0x29969d @ 0xf0969d __dbk_fcall_wrapper+0x29c0e8 dbkFCallWrapperAddr-0xd948 innopack+0x2add00 @ 0xf1dd00 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2553864 registers.edi: 0 registers.eax: 2553864 registers.ebp: 2553944 registers.edx: 0 registers.ebx: 3 registers.esi: 2 registers.ecx: 7	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 688128 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a37000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 143360 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a39000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 176128 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73422000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c03000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b52000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2024, 10:46 a.m.	process_identifier: 2816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73293000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\vucakq.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\is-TBD47.tmp\InnoPack.tmp
file	C:\Users\test22\AppData\Local\Temp\is-JUJJ4.tmp\vucakq.exe

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Z3AGN8				reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-Z3AGN8				reg_value	"C:\ProgramData\Remcos\remcos.exe"

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetectMalware
K7GW	Trojan ( 005b98fa1 )
K7AntiVirus	Trojan ( 005b98fa1 )
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Malware-gen
McAfeeD	ti!7423AA8BA840
Sophos	Mal/Generic-S
Kingsoft	Win32.Hack.Androm.a
Microsoft	Trojan:Win64/AsyncRat!rfn
GData	Win32.Malware.Obfus.FLS40T@susp
AhnLab-V3	Trojan/Win.Malware-gen.R661702
McAfee	Artemis!D1A71A41ADFF
Ikarus	Malware.Win32.Obfus
AVG	Win32:Malware-gen
Paloalto	generic.ml

Detects the presence of Wine emulator (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Sept. 25, 2024, 10:46 a.m.	ordinal: 0 function_address: 0x0098f7a8 function_name: wine_get_version module: ntdll module_address: 0x76f10000		3221225785	0
LdrGetProcedureAddress Sept. 25, 2024, 10:46 a.m.	ordinal: 0 function_address: 0x00c817b0 function_name: wine_get_version module: ntdll module_address: 0x76f10000		3221225785	0

InnoPack.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All