Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 6, 2025, 9:57 a.m.	Feb. 6, 2025, 9:59 a.m.

Size	93.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`59b40a406af1b307f204b246371db9bf`
SHA256	`5f1eaaa7781758b4830a2c576234d1687f95c1b058b48d833a4d71f2fa970d6b`
CRC32	`1FFAA5AD`
ssdeep	`768:WY3TmdD9O/pBcxYsbae6GIXb9pDX2KC98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3Y7E:hm3Ox6baIa9R/j00ljEwzGi1dDuD6gS`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

am.exe "C:\Users\test22\AppData\Local\Temp\am.exe"
1076
netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
2416
netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
2596
netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
2636
schtasks.exe schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\test22\AppData\Local\Temp/StUpdate.exe
2696

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
23.219.19.250	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Feb. 6, 2025, 9:57 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 6, 2025, 9:57 a.m.			0	0

Command line console output was observed (7 events)

Time & API	Arguments	Status	Return
WriteConsoleA Feb. 6, 2025, 9:57 a.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1
WriteConsoleA Feb. 6, 2025, 9:57 a.m.	buffer: Ok. console_handle: 0x00000007	1	1
WriteConsoleA Feb. 6, 2025, 9:57 a.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1
WriteConsoleA Feb. 6, 2025, 9:57 a.m.	buffer: Ok. console_handle: 0x00000007	1	1
WriteConsoleA Feb. 6, 2025, 9:57 a.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1
WriteConsoleA Feb. 6, 2025, 9:57 a.m.	buffer: Ok. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 6, 2025, 9:57 a.m.	buffer: SUCCESS: The scheduled task "StUpdate" has successfully been created. console_handle: 0x00000007	1	1

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74021000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74022000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00433000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00434000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00435000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00771000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00774000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 6, 2025, 9:57 a.m.	process_identifier: 1076 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00775000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\server.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Communicates with host for which no DNS query was performed (1 event)

host

23.219.19.250

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.1.15:5552

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.PrimeaClefAF.Trojan
Lionic	Trojan.Win32.Bladabindi.4!c
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	BehavesLike.Win32.Trojan.nm
Cylance	Unsafe
VIPRE	Gen:Heur.MSIL.Krypt.3
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Heur.MSIL.Krypt.3
K7GW	EmailWorm ( 00555f371 )
K7AntiVirus	EmailWorm ( 00555f371 )
Arcabit	Trojan.MSIL.Krypt.3
VirIT	Trojan.Win32.MulDrop7.DOQR
Symantec	Backdoor.Ratenjay
Elastic	Windows.Trojan.Njrat
ESET-NOD32	a variant of MSIL/Autorun.Spy.Agent.R
APEX	Malicious
Avast	Win32:KeyloggerX-gen [Trj]
ClamAV	Win.Packed.Generic-9795615-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Backdoor:MSIL/Autorun.76cd5473
NANO-Antivirus	Trojan.Win32.TrjGen.dkmeat
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.3
Rising	Backdoor.njRAT!1.A096 (CLASSIC)
Emsisoft	Gen:Heur.MSIL.Krypt.3 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.MulDrop7.62625
TrendMicro	Backdoor.MSIL.BLADABINDI.SMJJ
McAfeeD	Real Protect-LS!59B40A406AF1
Trapmine	malicious.high.ml.score
CTX	exe.trojan.msil
Sophos	Mal/ILAgent-E
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.59b40a406af1b307
Google	Detected
Avira	TR/Dropper.Gen
Kingsoft	malware.kb.c.1000
Gridinsoft	Ransom.Win32.Bladabindi.sa
Microsoft	Backdoor:MSIL/Bladabindi!rfn
ViRobot	Trojan.Win.Z.Bladabindi.95232.ECP
GData	MSIL.Backdoor.Agent.AXJ
Varist	W32/Trojan.BVX.gen!Eldorado
AhnLab-V3	Trojan/Win32.Bladabindi.R295982
McAfee	Trojan-FUTJ!59B40A406AF1
TACHYON	Backdoor/W32.DN-NjRat.95232.C
DeepInstinct	MALICIOUS
VBA32	Trojan.MSIL.Bladabindi.Heur
Malwarebytes	AutoRun.Spyware.Stealer.DDS
Ikarus	Trojan.Inject
Panda	Trj/CI.A
Zoner	Trojan.Win32.87452

am.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All