Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 13, 2024, 1:56 p.m.	Nov. 13, 2024, 2:04 p.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`952d79680f0faa1ffcbd5fab648e066f`
SHA256	`90238d6799041a37cbda12e4ce57e8b3b75d730bffbf5cd6340890050a52783d`
CRC32	`DE84E269`
ssdeep	`24576:rKFoVNhRl2SlnYSpyzljGXXlgbq3A8vWi/9T9E1xZ4rmNBylmb:5NcgRynbKRv5TA6rmNqmb`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

SEWanClt.exe "C:\Users\test22\AppData\Local\Temp\SEWanClt.exe"
2068

Name	Response	Post-Analysis Lookup
ip1.ahjoe.com		122.114.58.52
ip3.ahjoe.com		103.139.1.35
ip2.ahjoe.com		211.149.164.85

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 13, 2024, 1:56 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

UNICODE

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Nov. 13, 2024, 1:57 p.m.	stacktrace: sewanclt+0xb475c @ 0x4b475c sewanclt+0xb46aa @ 0x4b46aa sewanclt+0xb466b @ 0x4b466b sewanclt+0xc4ba9 @ 0x4c4ba9 sewanclt+0xc847f @ 0x4c847f sewanclt+0xc8795 @ 0x4c8795 sewanclt+0xc8946 @ 0x4c8946 sewanclt+0xc7a19 @ 0x4c7a19 sewanclt+0xc7a8b @ 0x4c7a8b sewanclt+0xca20d @ 0x4ca20d sewanclt+0x1f187 @ 0x41f187 sewanclt+0x4502 @ 0x404502 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 71761080 registers.edi: 71761268 registers.eax: 71761080 registers.ebp: 71761160 registers.edx: 0 registers.ebx: 4935348 registers.esi: 11004 registers.ecx: 7	1
__exception__ Nov. 13, 2024, 1:57 p.m.	stacktrace: sewanclt+0xb475c @ 0x4b475c sewanclt+0xb46aa @ 0x4b46aa sewanclt+0xb466b @ 0x4b466b sewanclt+0xc4ba9 @ 0x4c4ba9 sewanclt+0xc847f @ 0x4c847f sewanclt+0xc8795 @ 0x4c8795 sewanclt+0xc8946 @ 0x4c8946 sewanclt+0xc7a19 @ 0x4c7a19 sewanclt+0xc7a8b @ 0x4c7a8b sewanclt+0xca20d @ 0x4ca20d sewanclt+0x1f187 @ 0x41f187 sewanclt+0x4502 @ 0x404502 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 74710200 registers.edi: 74710388 registers.eax: 74710200 registers.ebp: 74710280 registers.edx: 0 registers.ebx: 4935348 registers.esi: 11004 registers.ecx: 7	1
__exception__ Nov. 13, 2024, 1:57 p.m.	stacktrace: sewanclt+0xb475c @ 0x4b475c sewanclt+0xb46aa @ 0x4b46aa sewanclt+0xb466b @ 0x4b466b sewanclt+0xc4ba9 @ 0x4c4ba9 sewanclt+0xc847f @ 0x4c847f sewanclt+0xc8795 @ 0x4c8795 sewanclt+0xc8946 @ 0x4c8946 sewanclt+0xc7a19 @ 0x4c7a19 sewanclt+0xc7a8b @ 0x4c7a8b sewanclt+0xca20d @ 0x4ca20d sewanclt+0x1f187 @ 0x41f187 sewanclt+0x4502 @ 0x404502 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 78904504 registers.edi: 78904692 registers.eax: 78904504 registers.ebp: 78904584 registers.edx: 0 registers.ebx: 4935348 registers.esi: 11004 registers.ecx: 7	1
__exception__ Nov. 13, 2024, 1:58 p.m.	stacktrace: sewanclt+0xb475c @ 0x4b475c sewanclt+0xb46aa @ 0x4b46aa sewanclt+0xb466b @ 0x4b466b sewanclt+0xc4ba9 @ 0x4c4ba9 sewanclt+0xc847f @ 0x4c847f sewanclt+0xc8795 @ 0x4c8795 sewanclt+0xc8946 @ 0x4c8946 sewanclt+0xc7a19 @ 0x4c7a19 sewanclt+0xc7a8b @ 0x4c7a8b sewanclt+0xca20d @ 0x4ca20d sewanclt+0x1f187 @ 0x41f187 sewanclt+0x4502 @ 0x404502 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 74710200 registers.edi: 74710388 registers.eax: 74710200 registers.ebp: 74710280 registers.edx: 0 registers.ebx: 4935348 registers.esi: 11004 registers.ecx: 7	1
__exception__ Nov. 13, 2024, 1:58 p.m.	stacktrace: sewanclt+0xb475c @ 0x4b475c sewanclt+0xb46aa @ 0x4b46aa sewanclt+0xb466b @ 0x4b466b sewanclt+0xc4ba9 @ 0x4c4ba9 sewanclt+0xc847f @ 0x4c847f sewanclt+0xc8795 @ 0x4c8795 sewanclt+0xc8946 @ 0x4c8946 sewanclt+0xc7a19 @ 0x4c7a19 sewanclt+0xc7a8b @ 0x4c7a8b sewanclt+0xca20d @ 0x4ca20d sewanclt+0x1f187 @ 0x41f187 sewanclt+0x4502 @ 0x404502 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 78904504 registers.edi: 78904692 registers.eax: 78904504 registers.ebp: 78904584 registers.edx: 0 registers.ebx: 4935348 registers.esi: 11004 registers.ecx: 7	1
__exception__ Nov. 13, 2024, 1:58 p.m.	stacktrace: sewanclt+0xb475c @ 0x4b475c sewanclt+0xb46aa @ 0x4b46aa sewanclt+0xb466b @ 0x4b466b sewanclt+0xc4ba9 @ 0x4c4ba9 sewanclt+0xc847f @ 0x4c847f sewanclt+0xc8795 @ 0x4c8795 sewanclt+0xc8946 @ 0x4c8946 sewanclt+0xc7a19 @ 0x4c7a19 sewanclt+0xc7a8b @ 0x4c7a8b sewanclt+0xca20d @ 0x4ca20d sewanclt+0x1f187 @ 0x41f187 sewanclt+0x4502 @ 0x404502 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 74710200 registers.edi: 74710388 registers.eax: 74710200 registers.ebp: 74710280 registers.edx: 0 registers.ebx: 4935348 registers.esi: 11004 registers.ecx: 7	1

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 13, 2024, 1:56 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Nov. 13, 2024, 1:56 p.m.	total_number_of_free_bytes: 9932648448 free_bytes_available: 9932648448 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Foreign language identified in PE resource (5 events)

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0016a264

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0016a264

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0016a264

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0016a264

size

0x00000468

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00176bbc

size

0x0000003e

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 13, 2024, 1:56 p.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 454656 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x03251000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00041c00', u'virtual_address': u'0x000f2000', u'entropy': 7.830181716635232, u'name': u'DATA', u'virtual_size': u'0x00041a80'}

entropy

7.83018171664

description

A section with a high entropy has been found

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.Dropper.th
ALYac	Gen:Variant.Zusy.461800
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.461800
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Zusy.461800
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Arcabit	Trojan.Zusy.D70BE8
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Delf_AGen.GB
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Generic-9949102-0
Alibaba	Trojan:Win32/Generic.343d002e
NANO-Antivirus	Trojan.Win32.Stealer.kqznli
MicroWorld-eScan	Gen:Variant.Zusy.461800
Rising	Trojan.Delf!8.67 (TFE:5:sI1bKygJT5U)
Emsisoft	Gen:Variant.Zusy.461800 (B)
F-Secure	Heuristic.HEUR/AGEN.1368435
DrWeb	Trojan.PWS.Stealer.36226
Zillya	Trojan.DelfAGen.Win32.1567
TrendMicro	TROJ_GEN.R002C0DKB24
McAfeeD	ti!90238D679904
CTX	exe.trojan.delf
Sophos	Mal/Generic-S
FireEye	Generic.mg.952d79680f0faa1f
Google	Detected
Avira	HEUR/AGEN.1368435
Antiy-AVL	Trojan/Win32.Delf
Kingsoft	malware.kb.a.993
Xcitium	Malware@#o0l3u4341yhc
Microsoft	Trojan:Win32/Zusy.MA!MTB
ViRobot	Trojan.Win.Z.Zusy.1488900
GData	Gen:Variant.Zusy.461800
AhnLab-V3	Trojan/Win.TrojanX-gen.R673416
McAfee	Artemis!952D79680F0F
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Click
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Win32.Delf
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0DKB24
Tencent	Malware.Win32.Gencirc.140cbb00
huorong	HEUR:Trojan/HVM37
MaxSecure	Trojan.Malware.207012609.susgen
Fortinet	W32/Delf_AGen.GB!tr

SEWanClt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All