Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 21, 2024, 1:36 p.m.	Oct. 21, 2024, 1:40 p.m.

Size	363.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`dc860de2a24ea3e15c496582af59b9cb`
SHA256	`9211154f8bd85ce85c52cfe91538e6ba2a25704b6efb84c64460ba4da20fa1a9`
CRC32	`F89ECEA5`
ssdeep	`6144:iUwFzqlqyEURK9rod9/or4txXZ1l4PyT6qdgNkwhjfdnw/omUS29zf7PT:zwFzqsynqM/M4tLw6DgNkQjfdwAZDPT`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

prem1.exe "C:\Users\test22\AppData\Local\Temp\prem1.exe"
2568
- MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2644

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 21, 2024, 1:36 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 21, 2024, 1:36 p.m.	stacktrace: prem1+0x6eee @ 0xc76eee BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 2817592 registers.edi: 4285584 registers.eax: 1 registers.ebp: 2817640 registers.edx: 2130566132 registers.ebx: 96 registers.esi: 3473408 registers.ecx: 2145648640	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cc7000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00030400', u'virtual_address': u'0x00028000', u'entropy': 7.9804653479191225, u'name': u'.data', u'virtual_size': u'0x000312c0'}

entropy

7.98046534792

description

A section with a high entropy has been found

entropy

0.548295454545

description

Overall entropy of this PE file is high

Yara rule detected in process memory (12 events)

description	Client_SW_User_Data_Stealer	rule	Client_SW_User_Data_Stealer
description	ftp clients info stealer	rule	infoStealer_ftpClients_Zero
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2644 region_size: 2371584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000064	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $¢båæõ¶æõ¶æõ¶u^¶þõ¶uk¶ëõ¶u_¶Üõ¶ï{v¶åõ¶fzô·äõ¶ï{f¶áõ¶æô¶õ¶uZ¶ôõ¶uh¶çõ¶Richæõ¶PELqµéfà ÈB"dà@0$@Ð©<à#\|$àô.textJÆÈ à.rdataæÎàÐÌ@@.data+!°@À.reloc*Dà#F¨@B base_address: 0x00400000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: LáA.?AVtype_info@@Næ@»±¿D ! 5A CPR S WYl m pr ) ¡¤§ ·Î× ÿÿÿÿÿÿÿÿÈAÈAÈAÈAÈAÈAÈAÈAÈAÈAC$÷A ÷A÷A÷A÷A÷A÷A÷AüöAôöAèöAÜöAÔöAÈöAÄöAÀöA¼öA¸öA´öA°öA¬öA¨öA¤öA öAöAöAöAöA\|öAtöA´öAlöAdöA\öAPöAHöA<öA0öA,öA(öAöAöAüõA ôõAìõAäõAÜõAÔõAÌõAÄõA´õA¤õAõAõAlõA\õAHõA@õA8õA0õA(õA õAõAõAõAõAøôAðôAèôAØôAÄôA¸ôA¬ôA õA ôAôAôApôA`ôALôA8ôA0ôA(ôAôAìóAØóA³B³B³B³B³BÈºB¨øA0ýA°þA³Bx´B abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZXµB¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÿÿÿÿ þÿÿÿ¬úA..ÀºBÈBÈBÈBÈBÈBÈBÈBÈBÈBÄºBÈBÈBÈBÈBÈBÈBÈBÈºB¨øAªúA.LáA.?AVlogic_error@std@@LáA.?AVlength_error@std@@LáA.?AVout_of_range@std@@LáA.?AVexception@std@@LáA.?AVbad_alloc@std@@ base_address: 0x0042b000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2644 process_handle: 0x00000064	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $¢båæõ¶æõ¶æõ¶u^¶þõ¶uk¶ëõ¶u_¶Üõ¶ï{v¶åõ¶fzô·äõ¶ï{f¶áõ¶æô¶õ¶uZ¶ôõ¶uh¶çõ¶Richæõ¶PELqµéfà ÈB"dà@0$@Ð©<à#\|$àô.textJÆÈ à.rdataæÎàÐÌ@@.data+!°@À.reloc*Dà#F¨@B base_address: 0x00400000 process_identifier: 2644 process_handle: 0x00000064	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 called NtSetContextThread to modify thread in remote process 2644
NtSetContextThread Oct. 21, 2024, 1:36 p.m.	registers.eip: 1995571652 registers.esp: 2293208 registers.edi: 0 registers.eax: 4285584 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000060 process_identifier: 2644	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2568 resumed a thread in remote process 2644
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000060 suspend_count: 1 process_identifier: 2644	1	0	0

Executed a process and injected code into it, probably while unpacking (11 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Oct. 21, 2024, 1:36 p.m.	thread_identifier: 2648 thread_handle: 0x00000060 process_identifier: 2644 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000064	1	1
NtGetContextThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000060	1	0
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2644 region_size: 2371584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000064	1	0
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $¢båæõ¶æõ¶æõ¶u^¶þõ¶uk¶ëõ¶u_¶Üõ¶ï{v¶åõ¶fzô·äõ¶ï{f¶áõ¶æô¶õ¶uZ¶ôõ¶uh¶çõ¶Richæõ¶PELqµéfà ÈB"dà@0$@Ð©<à#\|$àô.textJÆÈ à.rdataæÎàÐÌ@@.data+!°@À.reloc*Dà#F¨@B base_address: 0x00400000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: base_address: 0x00401000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: base_address: 0x0041e000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: LáA.?AVtype_info@@Næ@»±¿D ! 5A CPR S WYl m pr ) ¡¤§ ·Î× ÿÿÿÿÿÿÿÿÈAÈAÈAÈAÈAÈAÈAÈAÈAÈAC$÷A ÷A÷A÷A÷A÷A÷A÷AüöAôöAèöAÜöAÔöAÈöAÄöAÀöA¼öA¸öA´öA°öA¬öA¨öA¤öA öAöAöAöAöA\|öAtöA´öAlöAdöA\öAPöAHöA<öA0öA,öA(öAöAöAüõA ôõAìõAäõAÜõAÔõAÌõAÄõA´õA¤õAõAõAlõA\õAHõA@õA8õA0õA(õA õAõAõAõAõAøôAðôAèôAØôAÄôA¸ôA¬ôA õA ôAôAôApôA`ôALôA8ôA0ôA(ôAôAìóAØóA³B³B³B³B³BÈºB¨øA0ýA°þA³Bx´B abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZXµB¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÿÿÿÿ þÿÿÿ¬úA..ÀºBÈBÈBÈBÈBÈBÈBÈBÈBÈBÄºBÈBÈBÈBÈBÈBÈBÈBÈºB¨øAªúA.LáA.?AVlogic_error@std@@LáA.?AVlength_error@std@@LáA.?AVout_of_range@std@@LáA.?AVexception@std@@LáA.?AVbad_alloc@std@@ base_address: 0x0042b000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: base_address: 0x0063e000 process_identifier: 2644 process_handle: 0x00000064	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2644 process_handle: 0x00000064	1	1
NtSetContextThread Oct. 21, 2024, 1:36 p.m.	registers.eip: 1995571652 registers.esp: 2293208 registers.edi: 0 registers.eax: 4285584 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000060 process_identifier: 2644	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000060 suspend_count: 1 process_identifier: 2644	1	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Sabsik
Skyhigh	BehavesLike.Win32.Generic.fc
ALYac	Trojan.Generic.36842351
Cylance	Unsafe
VIPRE	Trojan.Generic.36842351
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.Generic.36842351
K7GW	Trojan ( 005bb4331 )
K7AntiVirus	Trojan ( 005bb4331 )
Arcabit	Trojan.Generic.D2322B6F
VirIT	Trojan.Win32.GenusT.EABB
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.HCID
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
Alibaba	Trojan:Win32/GenKryptik.b535e984
NANO-Antivirus	Virus.Win32.Gen.ccmw
MicroWorld-eScan	Trojan.Generic.36842351
Rising	Trojan.Kryptik!1.10450 (CLASSIC)
Emsisoft	Trojan.Generic.36842351 (B)
F-Secure	Trojan.TR/AD.Stealc.nbrdm
DrWeb	Trojan.PWS.Steam.37666
Zillya	Trojan.GenKryptik.Win32.988849
TrendMicro	Trojan.Win32.AMADEY.YXEJDZ
McAfeeD	Real Protect-LS!DC860DE2A24E
Trapmine	malicious.high.ml.score
CTX	exe.trojan.genkryptik
Sophos	Troj/Krypt-AKB
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.dc860de2a24ea3e1
Google	Detected
Avira	TR/AD.Stealc.nbrdm
Antiy-AVL	Trojan/Win32.GenKryptik
Kingsoft	Win32.Trojan-Spy.Stealer.gen
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Vidar.ASJ!MTB
ViRobot	Trojan.Win.Z.Sabsik.372088
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Win32.Trojan.PSE.1BJ486G
Varist	W32/Kryptik.MBW.gen!Eldorado
AhnLab-V3	Trojan/Win.PWSX-gen.R669469
McAfee	Artemis!DC860DE2A24E
DeepInstinct	MALICIOUS
VBA32	TrojanSpy.Stealer

prem1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All