Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 31, 2024, 6 p.m.	Oct. 31, 2024, 6:03 p.m.

Size	1.0MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`fca874fcb9f344ec26f3ae4d359e75d7`
SHA256	`56fc365c91e437d19a582a267bfee66ae4d2b4e8c9b039523119d7c9dc6c9fce`
CRC32	`F18DC5D4`
ssdeep	`24576:1+BNeMxzXC64aUn+EbWKpFOEMalcU3Aa2FTL3JkMt4Qe1CqxO9zTp:cLDxzXC64aUnqKpHlv3Al7JH4t1CUy`
PDB Path	C:\bmb0cz93jk\Literally.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

xnsjjxja.exe "C:\Users\test22\AppData\Local\Temp\xnsjjxja.exe"
2580
- xnsjjxja.exe "C:\Users\test22\AppData\Local\Temp\xnsjjxja.exe"
  2724

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

C:\bmb0cz93jk\Literally.pdb

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 31, 2024, 6:01 p.m.	stacktrace: xnsjjxja+0x11450 @ 0xd11450 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 7862740 registers.edi: 4247728 registers.eax: 1 registers.ebp: 7862792 registers.edx: 2130553844 registers.ebx: 72 registers.esi: 3604480 registers.ecx: 2126446592	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 31, 2024, 6 p.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dfe000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00054a00', u'virtual_address': u'0x000ac000', u'entropy': 7.983203870257028, u'name': u'.data', u'virtual_size': u'0x00056104'}

entropy

7.98320387026

description

A section with a high entropy has been found

entropy

0.324856046065

description

Overall entropy of this PE file is high

Yara rule detected in process memory (10 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 31, 2024, 6:01 p.m.	process_identifier: 2724 region_size: 385024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000004c	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL§ÍgàDÔ°Ð@à@RK¼.text¸BD `.rdata'%`&H@@.dataõbn@À.relocKLÐ@B base_address: 0x00400000 process_identifier: 2724 process_handle: 0x0000004c	1	1	0
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2724 process_handle: 0x0000004c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL§ÍgàDÔ°Ð@à@RK¼.text¸BD `.rdata'%`&H@@.dataõbn@À.relocKLÐ@B base_address: 0x00400000 process_identifier: 2724 process_handle: 0x0000004c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2580 called NtSetContextThread to modify thread in remote process 2724
NtSetContextThread Oct. 31, 2024, 6:01 p.m.	registers.eip: 1995571652 registers.esp: 1703676 registers.edi: 0 registers.eax: 4247728 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000048 process_identifier: 2724	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2580 resumed a thread in remote process 2724
NtResumeThread Oct. 31, 2024, 6:01 p.m.	thread_handle: 0x00000048 suspend_count: 1 process_identifier: 2724	1	0	0

Executed a process and injected code into it, probably while unpacking (11 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Oct. 31, 2024, 6:01 p.m.	thread_identifier: 2728 thread_handle: 0x00000048 process_identifier: 2724 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\xnsjjxja.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\xnsjjxja.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000004c	1	1
NtGetContextThread Oct. 31, 2024, 6:01 p.m.	thread_handle: 0x00000048	1	0
NtAllocateVirtualMemory Oct. 31, 2024, 6:01 p.m.	process_identifier: 2724 region_size: 385024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000004c	1	0
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL§ÍgàDÔ°Ð@à@RK¼.text¸BD `.rdata'%`&H@@.dataõbn@À.relocKLÐ@B base_address: 0x00400000 process_identifier: 2724 process_handle: 0x0000004c	1	1
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: base_address: 0x00401000 process_identifier: 2724 process_handle: 0x0000004c	1	1
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: base_address: 0x00446000 process_identifier: 2724 process_handle: 0x0000004c	1	1
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: base_address: 0x00449000 process_identifier: 2724 process_handle: 0x0000004c	1	1
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: base_address: 0x00459000 process_identifier: 2724 process_handle: 0x0000004c	1	1
WriteProcessMemory Oct. 31, 2024, 6:01 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2724 process_handle: 0x0000004c	1	1
NtSetContextThread Oct. 31, 2024, 6:01 p.m.	registers.eip: 1995571652 registers.esp: 1703676 registers.edi: 0 registers.eax: 4247728 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000048 process_identifier: 2724	1	0
NtResumeThread Oct. 31, 2024, 6:01 p.m.	thread_handle: 0x00000048 suspend_count: 1 process_identifier: 2724	1	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stelpak.4!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Stelpak
Skyhigh	BehavesLike.Win32.Generic.tc
Cylance	Unsafe
VIPRE	Gen:Heur.Kysler.1
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Trojan.GenericKD.74522364
K7GW	Trojan ( 005bc8561 )
K7AntiVirus	Trojan ( 005bc8561 )
Arcabit	Trojan.Generic.D4711EFC
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.HDET
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Stelpak.gen
Alibaba	Trojan:Win32/Lumma.fdb25592
MicroWorld-eScan	Trojan.GenericKD.74522364
Emsisoft	Trojan.GenericKD.74522364 (B)
F-Secure	Trojan.TR/Kryptik.mmduw
DrWeb	Trojan.PWS.Lumma.749
TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXEJ4Z
McAfeeD	ti!56FC365C91E4
Trapmine	malicious.high.ml.score
CTX	exe.trojan.stelpak
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.fca874fcb9f344ec
Google	Detected
Avira	TR/Kryptik.mmduw
Antiy-AVL	Trojan/Win32.Stelpak
Kingsoft	Win32.Trojan.Stelpak.gen
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Lumma.AECA!MTB
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.74522364
Varist	W32/Kryptik.MYH.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R674533
McAfee	Artemis!FCA874FCB9F3
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanPSW.RedLine
Malwarebytes	Trojan.MalPack.RND.Generic
Ikarus	Trojan.Win32.Krypt
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXEJ4Z
Tencent	Win32.Trojan.Stelpak.Wwhl
Fortinet	W32/Kryptik.HUTD!tr
AVG	Win32:MalwareX-gen [Trj]

xnsjjxja.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All