Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 7, 2025, 11:23 a.m.	Feb. 7, 2025, 11:30 a.m.

Size	282.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`da401fe564d861a209ff600633e4a845`
SHA256	`e317fe7d8d54c2935cb43168e3a65954c180f2c82d97fee05ada76d87af0c52c`
CRC32	`24A06275`
ssdeep	`6144:ITjvc2H8VD5tUTHmvlvEVj/LUsuULqmV4vGCaW7lTXNFwpV:OBTHmNEVj/LDuULVV4NVaV`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

laser.exe "C:\Users\test22\AppData\Local\Temp\laser.exe"
1440
runonce.exe "C:\Windows\SysWOW64\runonce.exe"
2520
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2724
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
www.topitch.top	A 162.0.231.203	162.0.231.203
www.tumbetgirislinki.fit	A 104.21.16.1 A 104.21.96.1 A 104.21.112.1 A 104.21.64.1 A 104.21.80.1 A 104.21.32.1 A 104.21.48.1	104.21.80.1
www.kjuw.party	A 134.122.133.80 CNAME zcdn.8383dns.com A 134.122.135.48	134.122.133.80
www.seasay.xyz	A 103.106.67.112	103.106.67.112
www.l63339.xyz	A 162.218.30.235	162.218.30.235
www.partflix.net	A 66.33.60.66 A 76.76.21.164	64.29.17.194
www.lucynoel6465.shop	A 104.21.16.1 A 104.21.96.1 A 104.21.112.1 A 104.21.64.1 A 104.21.80.1 A 104.21.32.1 A 104.21.48.1	104.21.80.1
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
103.106.67.112	Active	Moloch
104.21.112.1	Active	Moloch
134.122.135.48	Active	Moloch
162.0.231.203	Active	Moloch
162.218.30.235	Active	Moloch
164.124.101.2	Active	Moloch
45.33.6.223	Active	Moloch
66.33.60.66	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2027871	ET INFO Observed DNS Query to .fit TLD	Potentially Bad Traffic
TCP 192.168.56.103:49174 -> 104.21.112.1:80	2027880	ET INFO HTTP Request to Suspicious *.fit Domain	Potentially Bad Traffic
TCP 192.168.56.103:49181 -> 162.0.231.203:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 104.21.112.1:80	2027880	ET INFO HTTP Request to Suspicious *.fit Domain	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 104.21.112.1:80	2027880	ET INFO HTTP Request to Suspicious *.fit Domain	Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (11 events)

request	POST http://www.l63339.xyz/vhr7/
request	GET http://www.l63339.xyz/vhr7/?_skUVv5I=iaSfD1StI7hDT4qLO8uUiRMZCfzOjk7n7gYmLjmbAGxKTACTDmsojAseBTws2ae3nsJ7oX723eTW3ctEzpxpoAGWw5lYsZyjnFbtqE7RDBWvF3wnDTau3wgNIBcGnVL27k7EtEM=&kV=_HhJ3VPSKQ7ESY
request	GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip
request	POST http://www.tumbetgirislinki.fit/k566/
request	GET http://www.tumbetgirislinki.fit/k566/?_skUVv5I=RARW43WNMKajmHobr0h+FYOVnPeo69WXvXreCHJ6fEp5jkldk9mcfHn6UnU82+9OdsowyVV8wlYPh4e4mYqP64YSjghMuBr0WoXV5avhz1caW9rj8asJcaLGlYzIq2qtHDCYWJw=&kV=_HhJ3VPSKQ7ESY
request	POST http://www.lucynoel6465.shop/jgkl/
request	GET http://www.lucynoel6465.shop/jgkl/?_skUVv5I=hI+cEEoDMRK5HtHm9IZKcVLqeO4rH3Lo+nuR9x41ri89hVkyLZ4bcwu1mex5brSMZV4GWavlrf0/NsblmXI4eKNzhD3LBC/4pVsqqx1rwhcrHMghz/r2elc8myKvxM7B12e/f+g=&kV=_HhJ3VPSKQ7ESY
request	POST http://www.kjuw.party/e0jv/
request	GET http://www.kjuw.party/e0jv/?_skUVv5I=T5a+nPXa7vHYgORbmIzRnsYJn/5yKJpyja1Bw4L97U3J4ftOxLqNjjmK0MbXg0R7zOiA8ZTqxO8XWXqYcYfBl6po+rPbfzDYogoaVOnbbhZcGmBPmnt3DMj2ULUXFIgoaMg3MTM=&kV=_HhJ3VPSKQ7ESY
request	POST http://www.topitch.top/goj6/
request	GET http://www.topitch.top/goj6/?_skUVv5I=90Ns8gSHVfuKmwMvqoBDvov0x0TuRSc4CHvhiyRIaCFX9JzO3hXkGdLkIxbX7QQ8WI53tEhNGahKOUZIphRSegDcYcrC0WhrrPS45v/w4f2SjHeENV+PjA2DCpp4ca+uy9lGHYA=&kV=_HhJ3VPSKQ7ESY

Sends data using the HTTP POST Method (5 events)

request	POST http://www.l63339.xyz/vhr7/
request	POST http://www.tumbetgirislinki.fit/k566/
request	POST http://www.lucynoel6465.shop/jgkl/
request	POST http://www.kjuw.party/e0jv/
request	POST http://www.topitch.top/goj6/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.topitch.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 7, 2025, 11:23 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 278528 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01223000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 11:23 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01221000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 11:24 a.m.	process_identifier: 1440 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 11:24 a.m.	process_identifier: 2520 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

runonce.exe tried to sleep 142 seconds, actually delayed analysis time by 142 seconds

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00045800', u'virtual_address': u'0x00001000', u'entropy': 7.995371293227675, u'name': u'.text', u'virtual_size': u'0x00045684'}

entropy

7.99537129323

description

A section with a high entropy has been found

entropy

1.0

description

Overall entropy of this PE file is high

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Formbook.l!c
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.VirRansom.dc
ALYac	Gen:Variant.Mikey.173310
Cylance	Unsafe
VIPRE	Gen:Variant.Mikey.173310
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Mikey.173310
K7GW	Trojan ( 00536d121 )
K7AntiVirus	Trojan ( 00536d121 )
Arcabit	Trojan.Mikey.D2A4FE
VirIT	Trojan.Win32.GenusT.EOQB
Symantec	Trojan.Formbook
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Formbook.AK
APEX	Malicious
Avast	Win32:MiscX-gen [PUP]
Kaspersky	Trojan-Spy.Win32.Noon.bkdq
Alibaba	Trojan:Win32/FormBook.b35afeb8
MicroWorld-eScan	Gen:Variant.Mikey.173310
Rising	Trojan.Formbook!1.10495 (CLASSIC)
Emsisoft	Gen:Variant.Mikey.173310 (B)
F-Secure	Trojan.TR/Crypt.ZPACK.Gen
DrWeb	Trojan.Fbng.300
McAfeeD	Real Protect-LS!DA401FE564D8
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.formbook
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.da401fe564d861a2
Google	Detected
Avira	TR/Crypt.ZPACK.Gen
Antiy-AVL	Trojan/Win32.Formbook.ak
Kingsoft	malware.kb.a.1000
Gridinsoft	Ransom.Win32.Gen.sa
Xcitium	Malware@#3izi5iof8n80f
Microsoft	Trojan:Win32/FormBook.NF!MTB
GData	Win32.Trojan.PSE.1A2RRFJ
Varist	W32/Formbook.AG.gen!Eldorado
AhnLab-V3	Infostealer/Win.Formbook.R647393
McAfee	Artemis!DA401FE564D8
DeepInstinct	MALICIOUS
VBA32	Malware-Cryptor.General.3
Malwarebytes	Malware.Heuristic.2051
Ikarus	Trojan.Win32.Formbook
Panda	Trj/CI.A
Tencent	Win32.Trojan.Crypt.Psmw
MaxSecure	Trojan.Malware.300983.susgen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49171
dead_host	103.106.67.112:80

laser.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All