popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

6e1ed6447607ab4c30b3f389a53675e9.bin.exe

Gen1 Generic Malware Malicious Library UPX ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 19, 2024, 7:18 p.m. Nov. 19, 2024, 7:18 p.m.
Size 1.5MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 6e1ed6447607ab4c30b3f389a53675e9
SHA256 a69c11ca0cdbf0c75ac031ad24cb8c0ca88fbec1cfee5e26a9bbc3a64dc436b1
CRC32 E3435FF4
ssdeep 24576:T1V5bEb5v837jDHNCFYC/kNMqc5wwcotkPh2sQNxPkd5zwdSNLD2:ZfxCFNGMql5PnQNCrzy+
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Rolex
console_handle: 0x00000007
1 1 0
section .00cfg
section .SUN
section .POC
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x755c14dd
6e1ed6447607ab4c30b3f389a53675e9+0x889d7 @ 0xc89d7
6e1ed6447607ab4c30b3f389a53675e9+0x86b25 @ 0xc6b25
6e1ed6447607ab4c30b3f389a53675e9+0x131793 @ 0x171793

exception.instruction_r: 80 78 07 05 0f 84 a4 ff 04 00 f6 40 07 3f 0f 84
exception.symbol: RtlFreeHeap+0x3f RtlAllocateHeap-0x62 ntdll+0x2dfc4
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 188356
exception.address: 0x76f3dfc4
registers.esp: 4585980
registers.edi: 0
registers.eax: 7864464
registers.ebp: 4585996
registers.edx: 65024
registers.ebx: 7864472
registers.esi: 6815744
registers.ecx: 2438520116
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000dc000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00093c00', u'virtual_address': u'0x00001000', u'entropy': 6.953276635192939, u'name': u'.text', u'virtual_size': u'0x00093b98'} entropy 6.95327663519 description A section with a high entropy has been found
section {u'size_of_data': u'0x00098c00', u'virtual_address': u'0x0009f000', u'entropy': 6.86443069894066, u'name': u'.SUN', u'virtual_size': u'0x00098a7d'} entropy 6.86443069894 description A section with a high entropy has been found
section {u'size_of_data': u'0x0004c800', u'virtual_address': u'0x0013a000', u'entropy': 7.999439595264788, u'name': u'.POC', u'virtual_size': u'0x0004c800'} entropy 7.99943959526 description A section with a high entropy has been found
entropy 0.973845657088 description Overall entropy of this PE file is high
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 2648
process_handle: 0x0000002c
0 0

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 2648
process_handle: 0x0000002c
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000040
1 0 0
Process injection Process 2540 manipulating memory of non-child process 2648
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELt¿7gà  ºŒ@ @…Õ;Œ`h= =¼.text=   `.rdata¯ "@@.dataˆýPX0@À.CRTPˆ@@.reloch=`>Š@B
base_address: 0x00400000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer: `@
base_address: 0x00455000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2684
process_handle: 0x00000040
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELt¿7gà  ºŒ@ @…Õ;Œ`h= =¼.text=   `.rdata¯ "@@.dataˆýPX0@À.CRTPˆ@@.reloch=`>Š@B
base_address: 0x00400000
process_identifier: 2684
process_handle: 0x00000040
1 1 0
Process injection Process 2540 called NtSetContextThread to modify thread in remote process 2684
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 5896820
registers.edi: 0
registers.eax: 4230288
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000044
process_identifier: 2684
1 0 0
Process injection Process 2540 resumed a thread in remote process 2684
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000044
suspend_count: 1
process_identifier: 2684
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2652
thread_handle: 0x00000020
process_identifier: 2648
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\6e1ed6447607ab4c30b3f389a53675e9.bin.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\6e1ed6447607ab4c30b3f389a53675e9.bin.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000002c
1 1 0

NtGetContextThread

 thread_handle: 0x00000020
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
3221225496 0

CreateProcessInternalW

 thread_identifier: 2688
thread_handle: 0x00000044
process_identifier: 2684
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\6e1ed6447607ab4c30b3f389a53675e9.bin.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\6e1ed6447607ab4c30b3f389a53675e9.bin.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000040
1 1 0

NtGetContextThread

 thread_handle: 0x00000044
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000040
1 0 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELt¿7gà  ºŒ@ @…Õ;Œ`h= =¼.text=   `.rdata¯ "@@.dataˆýPX0@À.CRTPˆ@@.reloch=`>Š@B
base_address: 0x00400000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00442000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00445000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer: `@
base_address: 0x00455000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00456000
process_identifier: 2684
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2684
process_handle: 0x00000040
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 5896820
registers.edi: 0
registers.eax: 4230288
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000044
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x00000044
suspend_count: 1
process_identifier: 2684
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealerc.1m!c
Skyhigh BehavesLike.Win32.VirusWinExpiro.tc
McAfee Artemis!6E1ED6447607
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Lazy.625544
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.HDXO
APEX Malicious
Avast FileRepMalware [Trj]
Kaspersky UDS:Trojan.Win32.Stelpak.gen
MicroWorld-eScan Gen:Variant.Lazy.625544
Rising Stealer.Stealerc!8.17BE0 (CLOUD)
Emsisoft Gen:Variant.Lazy.625544 (B)
McAfeeD ti!A69C11CA0CDB
CTX exe.trojan.stealerc
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.6e1ed6447607ab4c
Antiy-AVL Trojan[PSW]/Win32.StealerC
Kingsoft Win32.Trojan-PSW.Stealerc.gen
Microsoft Trojan:Win32/Caynamer.A!ml
ZoneAlarm UDS:Trojan.Win32.Stelpak.gen
GData Gen:Variant.Lazy.625544
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.3679817882
Tencent Win32.Trojan.Genkryptik.Iflw
AVG FileRepMalware [Trj]