Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 3, 2025, 10:03 a.m.	Feb. 3, 2025, 10:28 a.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`545b933cac5def6ec43ca2cb6eac9d8e`
SHA256	`efce8cc629bb9f443613c7ec97b65020b514b9ee497d472ef24fed21bceb86c4`
CRC32	`4FFC6804`
ssdeep	`24576:DBSfwl41izrTEG7RcV2tuz0wNNLA/KKW5LGIk66+9ypvD2:DBjmiznEG7Z20sUKNGIk6hQD`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description)

systemetape.exe "C:\Users\test22\AppData\Local\Temp\systemetape.exe"
872

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Feb. 3, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Feb. 3, 2025, 10:03 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 3, 2025, 10:03 a.m.			0	0
IsDebuggerPresent Feb. 3, 2025, 10:03 a.m.			0	0
IsDebuggerPresent Feb. 3, 2025, 10:03 a.m.			0	0
IsDebuggerPresent Feb. 3, 2025, 10:03 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 3, 2025, 10:03 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2025, 10:03 a.m.	process_identifier: 872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0012cc00', u'virtual_address': u'0x00002000', u'entropy': 7.948360951806845, u'name': u'.text', u'virtual_size': u'0x0012cbd4'}

entropy

7.94836095181

description

A section with a high entropy has been found

entropy

0.998340248963

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: e646838ce3516509336944e49e612c78720ddcb2

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Lumma.1u!c
CAT-QuickHeal	Trojan.Ghanarava.1734873892ac9d8e
Skyhigh	Artemis!Trojan
McAfee	Artemis!545B933CAC5D
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.19166
Sangfor	Infostealer.Msil.Lumma.Vo1n
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jalapeno.19166
K7GW	Trojan ( 005bec7e1 )
K7AntiVirus	Trojan ( 005bec7e1 )
Arcabit	Trojan.Jalapeno.D4ADE
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AMVV
APEX	Malicious
Avast	Win32:BotX-gen [Trj]
Kaspersky	Trojan-PSW.Win32.Lumma.fdr
Alibaba	TrojanPSW:Win32/Lumma.68b6e4af
NANO-Antivirus	Trojan.Win32.Lumma.kuczow
MicroWorld-eScan	Gen:Variant.Jalapeno.19166
Rising	Malware.Obfus/MSIL@AI.84 (RDM.MSIL2:XgRQFtpy0iL+X+YCqQJsQQ)
Emsisoft	Gen:Variant.Jalapeno.19166 (B)
F-Secure	Trojan.TR/AD.Nekark.apkbe
DrWeb	Trojan.MulDrop28.57460
Zillya	Trojan.Lumma.Win32.1362
TrendMicro	TROJ_GEN.R002C0DAM25
McAfeeD	ti!EFCE8CC629BB
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.msil
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.545b933cac5def6e
Google	Detected
Avira	TR/AD.Nekark.apkbe
Kingsoft	Win32.Trojan-PSW.Lumma.fdr
Gridinsoft	Trojan.Win32.Agent.sa
Xcitium	Malware@#3si9i7u0c21wf
Microsoft	Trojan:MSIL/Amadey.AMA!MTB
GData	Gen:Variant.Jalapeno.19166
Varist	W32/ABTrojan.QAGZ-7460
AhnLab-V3	Trojan/Win.RATX-gen.C5708785
VBA32	Malware-Cryptor.MSIL.Alpha.Heur
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2839985248
Ikarus	Trojan-Spy.MSIL.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0DAM25

systemetape.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All