Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 19, 2024, 2:42 p.m.	Nov. 19, 2024, 2:46 p.m.

Size	2.6MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`5895f9e89c273cb76edb86600e0910a6`
SHA256	`454e73a40c15a323d0dd56b322529cf70e74064ef4089605cf25577634678f56`
CRC32	`7E3D3E5B`
ssdeep	`24576:PSqMZN8DPK8HqVh0lhSMXlb0fvEQLb36wpunE9yPMdO7JUKv9Rr:PS1Nn89Afv1LbK1E9QOUG`
Yara	Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

chelentano.exe "C:\Users\test22\AppData\Local\Temp\chelentano.exe"
1616

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 19, 2024, 1:29 p.m.			0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (37 events)

Time & API	Arguments	Status	Return
Process32FirstW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: System process_identifier: 4	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: services.exe process_identifier: 436	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: mobsync.exe process_identifier: 516	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: pw.exe process_identifier: 1904	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: wsqmcons.exe process_identifier: 2004	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: taskhost.exe process_identifier: 1156	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: sdclt.exe process_identifier: 1208	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: cmd.exe process_identifier: 300	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: SearchProtocolHost.exe process_identifier: 2032	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: conhost.exe process_identifier: 1552	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: SearchFilterHost.exe process_identifier: 1516	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: chelentano.exe process_identifier: 1616	1	1
Process32NextW Nov. 19, 2024, 1:29 p.m.	snapshot_handle: 0x0000000000000048 process_name: pw.exe process_identifier: 2084	1	1

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
ALYac	Gen:Variant.Cerbu.227571
Cylance	Unsafe
VIPRE	Gen:Variant.Cerbu.227571
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Gen:Variant.Cerbu.227571
Arcabit	Trojan.Cerbu.D378F3
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
MicroWorld-eScan	Gen:Variant.Cerbu.227571
Rising	Trojan.Kryptik@AI.85 (RDML:LrcP90h//c2NEOJmCmgIFw)
Emsisoft	Gen:Variant.Cerbu.227571 (B)
McAfeeD	ti!454E73A40C15
CTX	exe.trojan.cerbu
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.5895f9e89c273cb7
Google	Detected
Antiy-AVL	GrayWare/Win32.Wacapew
Gridinsoft	Trojan.Win64.Kryptik.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Cerbu.227571
Varist	W64/ABTrojan.LVGN-3543
McAfee	Artemis!5895F9E89C27
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H09KH24
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat

chelentano.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All