Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 8, 2025, 12:03 p.m.	March 8, 2025, 12:15 p.m.

Size	445.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ab09d0db97f3518a25cd4e6290862da7`
SHA256	`fc8cbb7809af3ab0b5f7ed07919bbd6c66366d1ed51681a8b91783ad8dafbb3d`
CRC32	`8FC61B50`
ssdeep	`6144:bncN0em3Zxf6ziPJK2EUC/elB/xvpzwxvapH4Wguea8VAi52597eN++ccPtmD:i0df6+PBtlBxqdaN4Wgq8VHu7eYDcPtM`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) IsPE32 - (no description)

91e9cb20-bc50-4ed6-aed4-e7c1719a15ae.exe "C:\Users\test22\AppData\Local\Temp\91e9cb20-bc50-4ed6-aed4-e7c1719a15ae.exe"
1704
- 91e9cb20-bc50-4ed6-aed4-e7c1719a15ae.exe "C:\Users\test22\AppData\Local\Temp\91e9cb20-bc50-4ed6-aed4-e7c1719a15ae.exe"
  2140

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
147.124.213.50	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 8, 2025, 12:03 p.m.			0	0
IsDebuggerPresent March 8, 2025, 12:03 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 8, 2025, 12:03 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.CSS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 8, 2025, 12:03 p.m.	stacktrace: exception.instruction_r: 8b 31 85 f6 eb 08 8d bd d5 04 00 00 eb 12 64 8b exception.instruction: mov esi, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2459e64 registers.esp: 3731416 registers.edi: 38116329 registers.eax: 1971261501 registers.ebp: 38116192 registers.edx: 38116431 registers.ebx: 0 registers.esi: 2939456477 registers.ecx: 2977573293	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00668000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e64000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00669000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02459000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0066a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005a400', u'virtual_address': u'0x0001c000', u'entropy': 7.999452518451699, u'name': u'.CSS', u'virtual_size': u'0x0005a400'}

entropy

7.99945251845

description

A section with a high entropy has been found

entropy

0.81214848144

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 8, 2025, 12:03 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

147.124.213.50

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 2140 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000200	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELSÉÀgàð°¹@P@Y4; ¸.textïð `.rdata!"ô@@.data¼Ó0R@À.reloc4;<h@B base_address: 0x00400000 process_identifier: 2140 process_handle: 0x00000200	1	1	0
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2140 process_handle: 0x00000200	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELSÉÀgàð°¹@P@Y4; ¸.textïð `.rdata!"ô@@.data¼Ó0R@À.reloc4;<h@B base_address: 0x00400000 process_identifier: 2140 process_handle: 0x00000200	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1704 called NtSetContextThread to modify thread in remote process 2140
NtSetContextThread March 8, 2025, 12:03 p.m.	registers.eip: 2005598660 registers.esp: 2817656 registers.edi: 0 registers.eax: 4241808 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001fc process_identifier: 2140	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1704 resumed a thread in remote process 2140
NtResumeThread March 8, 2025, 12:03 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2140	1	0	0

Executed a process and injected code into it, probably while unpacking (14 events)

Time & API	Arguments	Status	Return
NtResumeThread March 8, 2025, 12:03 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread March 8, 2025, 12:03 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1704	1	0
NtResumeThread March 8, 2025, 12:03 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 1704	1	0
CreateProcessInternalW March 8, 2025, 12:03 p.m.	thread_identifier: 2144 thread_handle: 0x000001fc process_identifier: 2140 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\91e9cb20-bc50-4ed6-aed4-e7c1719a15ae.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\91e9cb20-bc50-4ed6-aed4-e7c1719a15ae.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000200	1	1
NtGetContextThread March 8, 2025, 12:03 p.m.	thread_handle: 0x000001fc	1	0
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 2140 region_size: 413696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000200	1	0
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELSÉÀgàð°¹@P@Y4; ¸.textïð `.rdata!"ô@@.data¼Ó0R@À.reloc4;<h@B base_address: 0x00400000 process_identifier: 2140 process_handle: 0x00000200	1	1
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: base_address: 0x00401000 process_identifier: 2140 process_handle: 0x00000200	1	1
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: base_address: 0x00450000 process_identifier: 2140 process_handle: 0x00000200	1	1
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: base_address: 0x00453000 process_identifier: 2140 process_handle: 0x00000200	1	1
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: base_address: 0x00461000 process_identifier: 2140 process_handle: 0x00000200	1	1
WriteProcessMemory March 8, 2025, 12:03 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2140 process_handle: 0x00000200	1	1
NtSetContextThread March 8, 2025, 12:03 p.m.	registers.eip: 2005598660 registers.esp: 2817656 registers.edi: 0 registers.eax: 4241808 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001fc process_identifier: 2140	1	0
NtResumeThread March 8, 2025, 12:03 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2140	1	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stelpak.4!c
Skyhigh	BehavesLike.Win32.Generic.gc
ALYac	Trojan.GenericKDZ.110057
Cylance	Unsafe
VIPRE	Trojan.GenericKDZ.110057
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKDZ.110057
K7GW	Trojan ( 005c281c1 )
K7AntiVirus	Trojan ( 005c281c1 )
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.HGWU
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.Msilzilla-10042543-0
Alibaba	Trojan:MSIL/Stelpak.801953b5
NANO-Antivirus	Trojan.Win32.Lumma.kvzjhg
MicroWorld-eScan	Trojan.GenericKDZ.110057
Emsisoft	Trojan.GenericKDZ.110057 (B)
F-Secure	Trojan.TR/Kryptik.zivzb
DrWeb	Trojan.PWS.Lumma.1819
McAfeeD	Real Protect-LS!AB09D0DB97F3
CTX	exe.trojan.msil
Sophos	Troj/MSIL-THE
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.ab09d0db97f3518a
Webroot	Win.Trojan.Msil
Google	Detected
Avira	TR/Kryptik.zivzb
Antiy-AVL	RiskWare[Obfuscator]/MSIL.Reactor.a
Kingsoft	malware.kb.c.995
Gridinsoft	Spy.Win32.Gen.tr
Arcabit	Trojan.Generic.D1ADE9
ViRobot	Trojan.Win.Z.Genkryptik.456192.B
Microsoft	Trojan:MSIL/LummaC.AUMA!MTB
Varist	W32/MSIL_Kryptik.LZC.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5718144
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL
Ikarus	Trojan.MSIL.Krypt
Panda	Trj/Chgt.AD
Tencent	Malware.Win32.Gencirc.10c15d6f
huorong	Trojan/MSIL.Agent.vl
MaxSecure	Trojan.Malware.2329303.susgen
Fortinet	MSIL/GenKryptik.HGWU!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

91e9cb20-bc50-4ed6-aed4-e7c1719a15ae

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All