Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

pomoykaXL.exe

Generic Malware Malicious Library UPX Malicious Packer VMProtect Anti_VM AntiDebug PE64 PE File OS Processor Check PE32 AntiVM

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 23, 2025, 6:26 a.m.	Jan. 23, 2025, 6:33 a.m.

Size	9.2MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`756219b350b87a85f693dccbbf4cbc1e`
SHA256	`7dff620d738f6ca95281cdd0c9574a384f99ae0f02aeab4d9b0b5379b79ca1cb`
CRC32	`686A8FD5`
ssdeep	`98304:ry9bpMVdN2VDCNHkZM6wiuxPXdfFUJ3lQiXclIe99BaTYXX:rFBiK`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) VMProtect_Zero - VMProtect packed file anti_vm_detect - Possibly employs anti-virtualization techniques Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

pomoykaXL.exe "C:\Users\test22\AppData\Local\Temp\pomoykaXL.exe"
1492
- jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2444

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 22, 2025, 1:47 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Jan. 22, 2025, 1:47 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 22, 2025, 1:47 p.m.			0	0
IsDebuggerPresent Jan. 22, 2025, 1:47 p.m.			0	0
IsDebuggerPresent Jan. 22, 2025, 1:47 p.m.			0	0
IsDebuggerPresent Jan. 22, 2025, 1:47 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 22, 2025, 1:47 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (12 events)

section	.fptable
section	.xpdata
section	.arch
section	.vmp0
section	.xtls
section	.themida
section	.srdata
section	.vmp2
section	.enigma1
section	.dsstext
section	.enigma2
section	.vmp1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d61000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d62000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02100000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00542000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00566000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:47 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\oTIhMBaVu

Yara rule detected in process memory (7 events)

description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Bypass DEP				rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

The executable is likely packed with VMProtect (3 events)

section	.vmp0				description	Section name indicates VMProtect
section	.vmp2				description	Section name indicates VMProtect
section	.vmp1				description	Section name indicates VMProtect

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 22, 2025, 1:39 p.m.	process_identifier: 2444 region_size: 1171456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000004c	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL^{_dàf®= @@ à@T=W@cÀ H.text´ `.rsrcc@d @@.relocÀ@B base_address: 0x0000000000400000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: 0°= base_address: 0x000000000051c000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL^{_dàf®= @@ à@T=W@cÀ H.text´ `.rsrcc@d @@.relocÀ@B base_address: 0x0000000000400000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1492 resumed a thread in remote process 2444
NtResumeThread Jan. 22, 2025, 1:39 p.m.	thread_handle: 0x0000000000000048 suspend_count: 1 process_identifier: 2444	1	0	0

Executed a process and injected code into it, probably while unpacking (11 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Jan. 22, 2025, 1:39 p.m.	thread_identifier: 2448 thread_handle: 0x0000000000000048 process_identifier: 2444 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 1 process_handle: 0x000000000000004c	1	1	0
NtAllocateVirtualMemory Jan. 22, 2025, 1:39 p.m.	process_identifier: 2444 region_size: 1171456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000004c	1	0	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL^{_dàf®= @@ à@T=W@cÀ H.text´ `.rsrcc@d @@.relocÀ@B base_address: 0x0000000000400000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: base_address: 0x0000000000402000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: base_address: 0x0000000000514000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: 0°= base_address: 0x000000000051c000 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
WriteProcessMemory Jan. 22, 2025, 1:39 p.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2444 process_handle: 0x000000000000004c	1	1	0
NtResumeThread Jan. 22, 2025, 1:39 p.m.	thread_handle: 0x0000000000000048 suspend_count: 1 process_identifier: 2444	1	0	0
NtResumeThread Jan. 22, 2025, 1:47 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2444	1	0	0
NtResumeThread Jan. 22, 2025, 1:47 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2444	1	0	0
NtResumeThread Jan. 22, 2025, 1:47 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2444	1	0	0