Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 20, 2024, 9:17 a.m.	Oct. 20, 2024, 10:16 a.m.

Size	121.0KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`3b16dafca7fe3c55d66d70cab5adfb3e`
SHA256	`e7cfb2f10dbb17f5ae9dec1025926fb7993a504f0e569f0919e3afc3d9f6f185`
CRC32	`67DFD882`
ssdeep	`3072:+2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXM0:/bJhs7QW69hd1MMdxPe9N9uA0hu9TB50`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file

pyi6.exe "C:\Users\test22\AppData\Local\Temp\pyi6.exe"
524
- cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat C:\Users\test22\AppData\Local\Temp\pyi6.exe"
  2064
  - taskkill.exe taskkill /f /im sunday.exe
    2196
  - taskkill.exe taskkill /f /im lolclient.exe
    2296
  - taskkill.exe taskkill /f /im rigel.exe
    2364

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 20, 2024, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 20, 2024, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 20, 2024, 9:10 a.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (50 out of 76 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: taskkill console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: /f /im sunday.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: taskkill console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: /f /im lolclient.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: taskkill console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: /f /im rigel.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: z:\comgame\qqwb_client\config\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: y:\comgame\qqwb_client\config\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: X:\comgame\qqwb_client\config\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: y:\mystream\pcstory\storyservice\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: t:\mystream\pcstory\storyservice\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: F:\Terminal\nginx64\resty\core\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: w:\mystream\pcstory\storyservice\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: z:\Terminal\nginx64\resty\core\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: e:\mystream\pcstory\storyservice\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The system cannot find the drive specified. console_handle: 0x000000000000000b	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: copy console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: d:\mystream\pcstory\storyservice\rigel.exe C:\Users\Administrator\AppData\Local\Temp\ console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: The device is not ready. console_handle: 0x0000000000000007	1	1
WriteConsoleW Oct. 20, 2024, 9:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x0000000000000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.code

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat

Creates a suspicious process (1 event)

cmdline

"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat C:\Users\test22\AppData\Local\Temp\pyi6.exe"

Executes one or more WMI queries (3 events)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "rigel.exe")
wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sunday.exe")
wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "lolclient.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 20, 2024, 9:17 a.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd parameters: /c "C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat C:\Users\test22\AppData\Local\Temp\pyi6.exe" filepath: C:\Windows\System32\cmd	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00000c00', u'virtual_address': u'0x00022000', u'entropy': 7.117009258227418, u'name': u'.rsrc', u'virtual_size': u'0x00000aec'}

entropy

7.11700925823

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 20, 2024, 9:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2024, 9:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2024, 9:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	taskkill /f /im rigel.exe
cmdline	C:\Windows\System32\cmd /c "C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat C:\Users\test22\AppData\Local\Temp\pyi6.exe"
cmdline	taskkill /f /im lolclient.exe
cmdline	taskkill /f /im sunday.exe
cmdline	"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat C:\Users\test22\AppData\Local\Temp\pyi6.exe"

Deletes executed files from disk (3 events)

file	C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp\BE8A.bat
file	C:\Users\test22\AppData\Local\Temp\BE78.tmp
file	C:\Users\test22\AppData\Local\Temp\BE78.tmp\BE89.tmp

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 524 resumed a thread in remote process 2064
NtResumeThread Oct. 20, 2024, 9:17 a.m.	thread_handle: 0x00000000000001f4 suspend_count: 1 process_identifier: 2064	1	0	0

pyi6.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All