Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 18, 2024, 9:22 a.m.	Oct. 18, 2024, 9:24 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`44e1f98dde09e0525d219f374608325a`
SHA256	`ed927bf4bc97d352a224d1064017ce4bbf1da349012e8d418de3427febc01ee4`
CRC32	`D84BE4BE`
ssdeep	`24576:ffmMv6Ckr7Mny5QLYJXUPELH74GWu6f+CGml55HOA2:f3v+7/5QLY2sLH76u6fqELw`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

Bank Payment Confirmation Order#5600.exe "C:\Users\test22\AppData\Local\Temp\Bank Payment Confirmation Order#5600.exe"
2548
- RegSvcs.exe "C:\Users\test22\AppData\Local\Temp\Bank Payment Confirmation Order#5600.exe"
  2664

Name	Response	Post-Analysis Lookup
checkip.dyndns.org		193.122.130.0

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 8.8.8.8:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59002 -> 8.8.8.8:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59002 -> 8.8.8.8:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected
UDP 192.168.56.101:59002 -> 8.8.8.8:53	2043238	ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 18, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 18, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 18, 2024, 9:22 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 18, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Oct. 18, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Oct. 18, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Oct. 18, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Oct. 18, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Oct. 18, 2024, 9:22 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 18, 2024, 9:22 a.m.		1	1	0

Connects to a Dynamic DNS Domain (1 event)

domain

checkip.dyndns.org

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0405d000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 18, 2024, 9:22 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

checkip.dyndns.org

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 18, 2024, 9:22 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 18, 2024, 9:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2548 called NtSetContextThread to modify thread in remote process 2664
NtSetContextThread Oct. 18, 2024, 9:22 a.m.	registers.eip: 1995571652 registers.esp: 2816988 registers.edi: 0 registers.eax: 4473902 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000188 process_identifier: 2664	1	0	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.AutoIt.4!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	TrojanPWS.AutoIt.Zbot.S
Skyhigh	BehavesLike.Win32.Dropper.tc
Cylance	Unsafe
Sangfor	Trojan.Win32.Autoit.Vrto
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 700000111 )
K7AntiVirus	Trojan ( 700000111 )
VirIT	Trojan.Win32.AutoIt_Heur.L
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.Autoit.GMY
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:Trojan-PSW.Win32.Stealer.cjhm
Rising	Trojan.Injector/Autoit!1.10427 (CLASSIC)
DrWeb	Trojan.AutoIt.1503
TrendMicro	Cryp_Embed4
McAfeeD	ti!ED927BF4BC97
CTX	exe.trojan.autoit
Sophos	Troj/AutoIt-DHB
Google	Detected
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	Trojan:Win32/Autoitinject.PIIH!MTB
ZoneAlarm	UDS:Trojan-PSW.Win32.Stealer.cjhm
GData	MSIL.Trojan-Spy.Snake.E45O6B
Varist	W32/Autoit.XXWI-5918
McAfee	Artemis!44E1F98DDE09
DeepInstinct	MALICIOUS
VBA32	Trojan.Autoit.Crinje
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Trojan-Spy.SnakeKeylogger
TrendMicro-HouseCall	Cryp_Embed4
huorong	Trojan/AutoIT.Injector.ch
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	AutoIt/Agent.OM!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
alibabacloud	Trojan:Win/Phonzy.A9nj

Bank Payment Confirmation Order#5600.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All