popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mesh.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 11, 2024, 9:55 a.m. Nov. 11, 2024, 9:58 a.m.
Size 3.3MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 0d6e405856f8687fb1a06645a85bb0f3
SHA256 db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746
CRC32 D336BED8
ssdeep 49152:PX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QxR:PlRsZ47/QXoHUOfAoj1x6xR
PDB Path C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\MeshAgent\MeshAgent\Release\MeshService64.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
resource name AFX_DIALOG_LAYOUT
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefd4fa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 44033584
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 44039536
registers.r11: 44035344
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1954134408
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000074213000
process_handle: 0xffffffffffffffff
1 0 0
cmdline wmic os get oslanguage /FORMAT:LIST
cmdline wmic os get oslanguage /FORMAT:LIST
Bkav W32.Common.BD5714B0
Lionic Trojan.Win32.MeshAgent.4!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win64.Generic.wh
ALYac Trojan.GenericKD.74651774
Cylance Unsafe
VIPRE Trojan.GenericKD.74651774
BitDefender Trojan.GenericKD.74651774
K7GW Unwanted-Program ( 0049ebb41 )
K7AntiVirus Unwanted-Program ( 0049ebb41 )
Arcabit Trojan.Generic.D473187E
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 Win64/MeshAgent.B
Avast FileRepMalware [Misc]
Alibaba Trojan:Win64/MeshAgent.800480f5
MicroWorld-eScan Trojan.GenericKD.74651774
Rising Trojan.MeshAgent!8.1AB9D (CLOUD)
Emsisoft Trojan.GenericKD.74651774 (B)
F-Secure Trojan.TR/Redcap.buhvh
DrWeb Program.MeshAgent.2
Zillya Tool.MeshAgent.Win32.175
McAfeeD ti!DB8174175CEC
CTX exe.trojan.meshagent
Sophos Mal/Generic-S
FireEye Trojan.GenericKD.74651774
Jiangmin RemoteAdmin.MeshAgent.da
Google Detected
Avira TR/Redcap.buhvh
Antiy-AVL RiskWare/Win64.Agent
Gridinsoft Malware.Win64.MeshAgent.tr
GData Trojan.GenericKD.74651774
Varist W64/ABApplication.KSPP-1644
AhnLab-V3 Malware/Win.Generic.C5687324
McAfee Artemis!0D6E405856F8
DeepInstinct MALICIOUS
VBA32 Trojan.Mesh
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H09K824
Fortinet PossibleThreat.MU
AVG FileRepMalware [Misc]
Paloalto generic.ml