popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

111_2023-04-07_08-22.exe

email stealer Downloader Malicious Library Code injection Escalate priviledges Socket ScreenShot PWS KeyLogger DNS Sniff Audio persistence PE File PE32 AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 9, 2024, 12:51 p.m. Oct. 9, 2024, 12:55 p.m.
Size 193.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b1c1243d05e33560bfbda42ce515db8f
SHA256 5f149a72e815ea2a625790c88ed1e37f2fe70495dfa348c177c2405a9c246f01
CRC32 3963D582
ssdeep 3072:wfbAXHvklIsAlXl50hoe0TIUOGRnsayg6lmRkpD7JSPlH5jaXeqTB:aAclIxlXl50K1O2sayCk19onaXeqT
PDB Path C:\koficoxove\40\time\5\rukefa-78\bohiracafegala\ji.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
108.61.188.154 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path C:\koficoxove\40\time\5\rukefa-78\bohiracafegala\ji.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2584
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2584
region_size: 151552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004740000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
section {u'size_of_data': u'0x00020e00', u'virtual_address': u'0x00001000', u'entropy': 7.70670698735265, u'name': u'.text', u'virtual_size': u'0x00020cb6'} entropy 7.70670698735 description A section with a high entropy has been found
entropy 0.684895833333 description Overall entropy of this PE file is high
url http://microsoft.com/
description Communications over RAW Socket rule Network_TCP_Socket
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description File Downloader rule Network_Downloader
description Install itself for autorun at Windows startup rule Persistence
description email clients info stealer rule infoStealer_emailClients_Zero
description Run a KeyLogger rule KeyLogger
host 108.61.188.154
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 1425408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2680
process_handle: 0x00000080
1 1 0
Process injection Process 2584 called NtSetContextThread to modify thread in remote process 2680
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4220830
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2680
1 0 0
file C:\Users\test22\AppData\Local\Temp\111_2023-04-07_08-22.exe:Zone.Identifier
Process injection Process 2584 resumed a thread in remote process 2680
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2680
1 0 0
dead_host 108.61.188.154:5200
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2684
thread_handle: 0x0000007c
process_identifier: 2680
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\111_2023-04-07_08-22.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\111_2023-04-07_08-22.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\111_2023-04-07_08-22.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2680
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 1425408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2680
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4220830
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2680
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2680
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Convagent.4!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Lockbit.ch
ALYac Gen:Variant.Ransom.Loki.880
Cylance Unsafe
VIPRE Gen:Variant.Ransom.Loki.880
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Ransom.Loki.880
K7GW Trojan ( 005a23a61 )
K7AntiVirus Trojan ( 005a23a61 )
Arcabit Trojan.Ransom.Loki.880
VirIT Trojan.Win32.GenusT.EFKD
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HTGR
APEX Malicious
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
Alibaba TrojanSpy:Win32/Stealer.623b90f2
NANO-Antivirus Trojan.Win32.Mokes.jvkbph
MicroWorld-eScan Gen:Variant.Ransom.Loki.880
Rising Trojan.Kryptik!8.8 (TFE:5:6nvXo68UUjB)
Emsisoft Gen:Variant.Ransom.Loki.880 (B)
F-Secure Trojan.TR/Crypt.Agent.rzrva
DrWeb Trojan.PWS.Stealer.33898
Zillya Trojan.Kryptik.Win32.4130783
McAfeeD ti!5F149A72E815
Trapmine malicious.moderate.ml.score
CTX exe.trojan.kryptik
Sophos Troj/Krypt-VK
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.b1c1243d05e33560
Jiangmin Trojan.PSW.Stealerc.k
Google Detected
Avira TR/Crypt.Agent.rzrva
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.dd!n
Microsoft Trojan:Win32/Smokeloader.GHM!MTB
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
GData Gen:Variant.Ransom.Loki.880
Varist W32/Kryptik.JLW.gen!Eldorado
AhnLab-V3 Trojan/Win.TrojanX-gen.R568324
Acronis suspicious
McAfee GenericRXVT-ES!B1C1243D05E3
DeepInstinct MALICIOUS
VBA32 Malware-Cryptor.2LA.gen