popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Coc%20Coc.exe

Emotet Generic Malware Malicious Library UPX Malicious Packer AntiDebug PE64 PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 2, 2025, 10:36 a.m. Jan. 2, 2025, 10:38 a.m.
Size 3.8MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 1a15dd31838dee5ca5aae7d4771cb451
SHA256 0698347cb68341078844c04d3003ae98502d3efe181b654a4de3271c3c43e887
CRC32 DE00FB3F
ssdeep 98304:+3RdEXvwmv0wI5MuUoIkkoJxxE3XnwXuUsHUhwn6:+33WvDv0wyMuUUkoREHVUsHUun6
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming>
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: Copy
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: portable_util.exe "C:\Program Files\CocCoc\Browser\Application" /y
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: The system cannot find the path specified.
console_handle: 0x000000000000000b
1 1 0

WriteConsoleW

 buffer: 0 file(s) copied.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming>
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: Copy
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: setup.exe "C:\Program Files\CocCoc\Browser\Application" /y
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: The system cannot find the path specified.
console_handle: 0x000000000000000b
1 1 0

WriteConsoleW

 buffer: 0 file(s) copied.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming>
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: portable_util.exe
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: --register-coccoc-portable --force-uid=3849d47c-687c-49be-b315-4e062899d124 --skip-import --skip-welcome --do-not-create-shortcut --force-regenerate-hid
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming>
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: start
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: browser.exe truyenhay247.click https://upodaitie.net/4/8080037
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: The system cannot find the file browser.exe.
console_handle: 0x000000000000000b
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .code
file C:\Users\test22\AppData\Roaming\setup.exe
file C:\Users\test22\AppData\Local\Temp\C07C.tmp\C07D.tmp\C07E.bat
file C:\Users\test22\AppData\Roaming\portable_util.exe
file C:\Users\test22\AppData\Roaming\CocCocSetup.exe
cmdline "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\C07C.tmp\C07D.tmp\C07E.bat C:\Users\test22\AppData\Local\Temp\Coc%20Coc.exe"
file C:\Users\test22\AppData\Roaming\CocCocSetup.exe
file C:\Users\test22\AppData\Roaming\setup.exe
file C:\Users\test22\AppData\Roaming\portable_util.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\C07C.tmp\C07D.tmp\C07E.bat C:\Users\test22\AppData\Local\Temp\Coc%20Coc.exe"
filepath: C:\Windows\System32\cmd
1 1 0
section {u'size_of_data': u'0x003ac600', u'virtual_address': u'0x00022000', u'entropy': 7.985065850053966, u'name': u'.rsrc', u'virtual_size': u'0x003ac454'} entropy 7.98506585005 description A section with a high entropy has been found
entropy 0.969708687806 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\C07C.tmp\C07D.tmp\C07E.bat C:\Users\test22\AppData\Local\Temp\Coc%20Coc.exe"
cmdline C:\Windows\System32\cmd /c "C:\Users\test22\AppData\Local\Temp\C07C.tmp\C07D.tmp\C07E.bat C:\Users\test22\AppData\Local\Temp\Coc%20Coc.exe"
file C:\Users\test22\AppData\Roaming\portable_util.exe
Process injection Process 1820 resumed a thread in remote process 2064
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000224
suspend_count: 1
process_identifier: 2064
1 0 0
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Gen.tqzj
tehtris Generic.Malware
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Ghanarava.17295029471cb451
Skyhigh BehavesLike.Win64.Dropper.wc
ALYac Gen:Variant.Cerbu.213170
Cylance Unsafe
VIPRE Gen:Variant.Cerbu.213170
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_70% (W)
BitDefender Gen:Variant.Cerbu.213170
K7GW Riskware ( 00584baa1 )
K7AntiVirus Riskware ( 00584baa1 )
Arcabit Trojan.Cerbu.D340B2
VirIT Trojan.Win32.Banker1.BMNA
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Avast Win64:Malware-gen
Kaspersky Trojan-Dropper.Win32.Dapato.sbab
Alibaba TrojanDropper:Win32/Dapato.0b812dcc
MicroWorld-eScan Gen:Variant.Cerbu.213170
Rising Trojan.Convagent!8.12323 (CLOUD)
Emsisoft Gen:Variant.Cerbu.213170 (B)
Zillya Trojan.Generic.Win32.838255
McAfeeD ti!0698347CB683
CTX exe.trojan.generic
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.1a15dd31838dee5c
Google Detected
Antiy-AVL Trojan/Win32.SchoolGirl
Kingsoft malware.kb.a.954
Gridinsoft Trojan.Win64.Agent.bot!s1
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Cerbu.213170
Varist W64/Bulz.BB.gen!Eldorado
McAfee Artemis!1A15DD31838D
DeepInstinct MALICIOUS
VBA32 TrojanPSW.Win64.Banker
TrendMicro-HouseCall TROJ_GEN.R002H0CJJ24
Tencent Malware.Win32.Gencirc.141ec354
MaxSecure Trojan.Malware.294739747.susgen
Fortinet W64/CoinMiner.526230!tr
AVG Win64:Malware-gen
Paloalto generic.ml
alibabacloud Trojan:Win/Convagent.gyf