popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

crypted.exe

Generic Malware Malicious Library UPX ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 11, 2024, 9:35 a.m. Nov. 11, 2024, 9:40 a.m.
Size 1.2MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 e1d09be68de1be491cdb2870bfc90854
SHA256 6b2c384e64992914ec049762e153d4592c7dc2511b8cc079843c4d8195210c23
CRC32 6ECA732E
ssdeep 24576:W6hD7LpDPaCoflmQMOsaED7biogA/kItUbLA8ouzEgKl8QDj7:jTp7oLlx+7bc2kI+bLPEDl3Dj7
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: XA
console_handle: 0x00000007
1 1 0
section .00cfg
section .open
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
crypted+0x1c7bf @ 0x25c7bf

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 6355604
registers.edi: 4248576
registers.eax: 1
registers.ebp: 6355740
registers.edx: 2130566132
registers.ebx: 32
registers.esi: 131072
registers.ecx: 2099576832
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00322000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000d3a00', u'virtual_address': u'0x00001000', u'entropy': 7.037408583368194, u'name': u'.text', u'virtual_size': u'0x000d389a'} entropy 7.03740858337 description A section with a high entropy has been found
section {u'size_of_data': u'0x0004c200', u'virtual_address': u'0x000ea000', u'entropy': 7.999372233205789, u'name': u'.open', u'virtual_size': u'0x0004c200'} entropy 7.99937223321 description A section with a high entropy has been found
entropy 0.944604021338 description Overall entropy of this PE file is high
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 364544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL‘3%gà øÆÔ@@…80Œ@<AŒ1È.textZöø `.rdata]%&ü@@.datapð@^"@À.reloc<A@B€@B
base_address: 0x00400000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2660
process_handle: 0x0000002c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL‘3%gà øÆÔ@@…80Œ@<AŒ1È.textZöø `.rdata]%&ü@@.datapð@^"@À.reloc<A@B€@B
base_address: 0x00400000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0
Process injection Process 2552 called NtSetContextThread to modify thread in remote process 2660
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 5700424
registers.edi: 0
registers.eax: 4248576
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2660
1 0 0
Process injection Process 2552 resumed a thread in remote process 2660
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2660
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2664
thread_handle: 0x00000020
process_identifier: 2660
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\crypted.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\crypted.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000002c
1 1 0

NtGetContextThread

 thread_handle: 0x00000020
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 364544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL‘3%gà øÆÔ@@…80Œ@<AŒ1È.textZöø `.rdata]%&ü@@.datapð@^"@À.reloc<A@B€@B
base_address: 0x00400000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00441000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00444000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00454000
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2660
process_handle: 0x0000002c
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 5700424
registers.edi: 0
registers.eax: 4248576
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2660
1 0 0

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2660
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Sodinokibi.4!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.tc
ALYac Trojan.GenericKD.74730982
Cylance Unsafe
VIPRE Trojan.GenericKD.74730982
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.74730982
Arcabit Trojan.Generic.D4744DE6
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.HDQC
APEX Malicious
Avast Win32:Xpaj-gen [Inf]
Kaspersky HEUR:Trojan.Win32.Stelpak.gen
MicroWorld-eScan Trojan.GenericKD.74730982
Rising Trojan.Stelpak!8.1B214 (CLOUD)
Emsisoft Trojan.GenericKD.74730982 (B)
DrWeb Trojan.PWS.Lumma.801
McAfeeD ti!6B2C384E6499
Trapmine suspicious.low.ml.score
CTX exe.trojan.sodinokibi
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.e1d09be68de1be49
Google Detected
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.HeurC.KVMH008.a
Gridinsoft Ransom.Win32.Sodinokibi.sa
Xcitium Malware@#2468x9xuyh07c
Microsoft Trojan:Win32/Sabsik.FL.A!ml
GData Trojan.GenericKD.74730982
Varist W32/ABTrojan.AVEH-8158
AhnLab-V3 Trojan/Win.Malware-gen.R678257
McAfee Sodinokibi!E1D09BE68DE1
DeepInstinct MALICIOUS
Malwarebytes Trojan.Injector
Ikarus Trojan.Win32.Krypt
Panda Trj/RansomGen.A
Fortinet W32/Sodinokibi!tr
AVG Win32:Xpaj-gen [Inf]
Paloalto generic.ml