popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1654365431.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX PE64 PE File OS Processor Check MZP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 12, 2024, 9:31 a.m. Oct. 12, 2024, 9:38 a.m.
Size 5.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 31d649663149dabd99c51b71e60a4a91
SHA256 2acb9052db5b304a822f8cd1169e31327e967e06ff78064997ea8a5003e783ec
CRC32 487FE80E
ssdeep 49152:eDShb1KwGF4Ilow5sADndfK0IptgSoP6MRM2BTXwmlPJmqHc4a/:LQK0/lX9PJhHc
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
146.70.24.213 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .didata
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 245760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002810000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 245760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 196608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002560000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002890000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 208896
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
process_handle: 0xffffffffffffffff
-1073741800 0

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0
name RT_ICON language LANG_CZECH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_MOROCCO offset 0x0053081c size 0x00000468
name RT_ICON language LANG_CZECH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_MOROCCO offset 0x0053081c size 0x00000468
name RT_ICON language LANG_CZECH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_MOROCCO offset 0x0053081c size 0x00000468
name RT_ICON language LANG_CZECH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_MOROCCO offset 0x0053081c size 0x00000468
name RT_ICON language LANG_CZECH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_MOROCCO offset 0x0053081c size 0x00000468
name RT_ICON language LANG_CZECH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_MOROCCO offset 0x0053081c size 0x00000468
name RT_GROUP_ICON language LANG_CZECH filetype data sublanguage SUBLANG_ARABIC_MOROCCO offset 0x00574fd4 size 0x0000005a
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 146.70.24.213
Sangfor Trojan.Win32.Agent.V1m1
Symantec ML.Attribute.HighConfidence
Avast Win64:DropperX-gen [Drp]
Kaspersky UDS:DangerousObject.Multi.Generic
Rising Hacktool.RDPWrap!8.F5FA (LESS:bWQ1OjpfhfdBffwb)
DrWeb Trojan.MulDrop28.29339
McAfeeD ti!2ACB9052DB5B
Microsoft Trojan:Win32/Sonbokli.A!cl
ZoneAlarm UDS:DangerousObject.Multi.Generic
McAfee Artemis!31D649663149
huorong Trojan/Agent.bul
AVG Win64:DropperX-gen [Drp]