Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 24, 2024, 10:59 a.m.	Oct. 24, 2024, 11:07 a.m.

Size	170.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4336581e9f9024a927e63607e28c5afe`
SHA256	`df0dabfd12fa40342a45018032de660b94f83e928ecf40546e124109f0a94522`
CRC32	`9A1F5B5F`
ssdeep	`3072:QB5iVaXBDiVa0BgiVa9tJQ9lS+yJ6W4tJQ9lS+yJ6W4:Q5iVaxDiVa0giVavJQPk4JQPk4`
Yara	Win_Backdoor_njRAT_Zero - Win Backdoor njRAT PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware mzp_file_format - MZP(Delphi) file format

get.php "C:\Users\test22\AppData\Local\Temp\get.php"
2544
- extrimhack_csgo_05.03.2023.exe "C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe"
  2612
- System.exe "C:\Users\test22\AppData\Local\Temp\System.exe"
  2652
netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\Pascal.exe" "Pascal.exe" ENABLE
2880

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 24, 2024, 10:59 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA Oct. 24, 2024, 11 a.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1	0
WriteConsoleA Oct. 24, 2024, 11 a.m.	buffer: Ok. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 24, 2024, 10:59 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00413000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00414000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00591000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2024, 10:59 a.m.	process_identifier: 2652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe
file	C:\Users\test22\AppData\Local\Temp\System.exe

Creates hidden or system file (5 events)

Time & API	Arguments	Status	Return
NtCreateFile Oct. 24, 2024, 10:59 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x0000007c filepath: C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 2 (FILE_SHARE_WRITE)	1	0
NtCreateFile Oct. 24, 2024, 10:59 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000278 filepath: C:\Users\test22\AppData\Local\Temp\System.exe desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\System.exe create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 2 (FILE_SHARE_WRITE)	1	0
NtCreateFile Oct. 24, 2024, 10:59 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 4294967295 () share_access: 2 (FILE_SHARE_WRITE)		3221225539
NtCreateFile Oct. 24, 2024, 10:59 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Local\Temp\System.exe desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\System.exe create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 4294967295 () share_access: 2 (FILE_SHARE_WRITE)		3221225539
SetFileAttributesW Oct. 24, 2024, 10:59 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Local\Temp\System.exe filepath: C:\Users\test22\AppData\Local\Temp\System.exe	1	1

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe
file	C:\Users\test22\AppData\Local\Temp\System.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\System.exe
file	C:\Users\test22\AppData\Local\Temp\extrimhack_csgo_05.03.2023.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.0.106:6522

File has been identified by 66 AntiVirus engines on VirusTotal as malicious (50 out of 66 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Rbot.leZz
Elastic	Windows.Trojan.Njrat
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.GenericFC.S19436243
Skyhigh	BehavesLike.Win32.Generic.cm
ALYac	Trojan.GenericKD.65811880
Cylance	unsafe
VIPRE	Trojan.GenericKD.65811880
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004bdc281 )
BitDefender	Trojan.GenericKD.65811880
K7GW	Trojan ( 004bdc281 )
Arcabit	Trojan.Generic.D3EC35A8
Baidu	Win32.Trojan-Dropper.Delf.as
VirIT	Trojan.Win32.Generic.CKWZ
Symantec	SMG.Heur!gen
ESET-NOD32	Win32/TrojanDropper.Delf.OEF
APEX	Malicious
McAfee	GenericRXDR-OQ!4336581E9F90
Avast	Win32:Evo-gen [Trj]
ClamAV	Win.Packed.Bladabindi-7994427-0
Kaspersky	Trojan-Dropper.Win32.Delf.eimp
Alibaba	Ransom:Win32/Weenloc.e8c
NANO-Antivirus	Trojan.Win32.Dropper.flagce
MicroWorld-eScan	Trojan.GenericKD.65811880
Rising	Dropper.Delf!1.C7FF (CLASSIC)
Emsisoft	Trojan.GenericKD.65811880 (B)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.Packed.20771
Zillya	Dropper.Delf.Win32.35091
TrendMicro	TROJ_BINDER.SMBD
McAfeeD	Real Protect-LS!4336581E9F90
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.4336581e9f9024a9
Sophos	Mal/Emogen-Z
Ikarus	Worm.Win32.Agent
Jiangmin	Trojan/Genome.bawa
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/ATRAPS.Gen
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Dropper]/Win32.Delf.efnz
Kingsoft	malware.kb.a.996
Gridinsoft	Backdoor.Win32.Gen.zv!s1
Xcitium	TrojWare.Win32.TrojanDropper.Delf.SOC@572vwy
Microsoft	Backdoor:MSIL/Bladabindi.AJ
ViRobot	Trojan.Win32.A.Scar.451584.A
ZoneAlarm	Trojan-Dropper.Win32.Delf.eimp
GData	Trojan.GenericKD.65811880

get.php

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All