Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.20 09:11
mainbas.bat
11.20 09:11
dll007.dll
11.20 09:11
exe004.exe
11.20 09:11
exe010.exe
11.20 09:11
blecher.exe
11.20 09:11
GetAdapterInfo.exe
11.20 09:11
dll004.dll
11.20 09:11
dll008.dll
11.20 09:11
bestthingsalwaysgetbes...
11.20 09:11
DKM-9067291.pdf.lnk

Latest News
11.20 01:11
Anyone Can Buy Data Tr...
11.20 12:11
ISC Stormcast For Wedn...
11.20 12:11
코막힘 해결사 올바스 브랜드, 바르는 ‘...
11.20 12:11
Batteries Not Included...
11.20 12:11
AI 딥테크 스타트업 폴리머라이즈, ‘폴...
11.20 11:11
62만 유튜버 연츄, 인천 노인주간보호센...
11.20 11:11
Unveiling LIMINAL PAND...
11.20 11:11
이천청솔기숙학원, 2025 입시 준비 조...
11.20 11:11
모즈 탄소매트, 전자파 없는 원적외선 매...
11.20 11:11
유어네스트 ‘이터널 라이트’ 아틀리에 투...

Summary | ZeroBOX

blecher.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 20, 2024, 9:15 a.m.	Nov. 20, 2024, 9:19 a.m.

Size	3.3MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`339ae0260481a7cf89f3f5e3d506ff37`
SHA256	`71201202878157570c3be3e6a6e3022a194e9e879872c916e3c62e72cb661ba8`
CRC32	`27AECDF0`
ssdeep	`24576:rmCkR8pID8IfP0RLao4ur1ASah0lhSMXluuQfkaTVMLGbwo3rPzULXKUxTgtdSq:rzkRrf8RLao4weuQM/LDkrPaX3C`
Yara	Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

blecher.exe "C:\Users\test22\AppData\Local\Temp\blecher.exe"
1820

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.130.145.152	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001da0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003a3000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776ca000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776ca000 process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001da0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003a5000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fb7a000 process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 region_size: 1302528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000039d000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Nov. 20, 2024, 9:15 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fb76000 process_handle: 0xffffffffffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 20, 2024, 9:15 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

45.130.145.152

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

45.130.145.152:15666