Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 23, 2025, 2:42 p.m.	April 23, 2025, 2:45 p.m.

Size	6.5KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`55f4a1393e2edafea92d7ebab09c92d6`
SHA256	`9d019136cb08075cc3c25e23ccff919b16eb79060c45ceba1004edc96980416d`
CRC32	`01049BD4`
ssdeep	`96:WzUCJPrlsU246sUHOYd3Bdl9/jD5zmAJrho4/bKLzNt:UxebPxdjD9rhofN`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

c.exe "C:\Users\test22\AppData\Local\Temp\c.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 23, 2025, 2:42 p.m.			0	0
IsDebuggerPresent April 23, 2025, 2:42 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA April 23, 2025, 2:42 p.m.	buffer: PortTran by K8gege console_handle: 0x00000007	1	1	0
WriteConsoleA April 23, 2025, 2:42 p.m.	buffer: usage: PortTranC.exe TragetIP TargetPort VpsIP TranPort console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 23, 2025, 2:42 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02260000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00365000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0036b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00367000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2025, 2:42 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Lionic	Hacktool.Win32.Generic.3!c
CAT-QuickHeal	Trojan.Ghanarava.17435483459c92d6
Skyhigh	RDN/Generic PUP.z
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.Vzl5
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Riskware ( 005ba7b91 )
K7AntiVirus	Riskware ( 005ba7b91 )
Symantec	Hacktool.Gen
ESET-NOD32	a variant of MSIL/Riskware.HackTool.Agent.EE
APEX	Malicious
Avast	FileRepMalware [Misc]
Rising	Hacktool.Agent!8.335 (CLOUD)
F-Secure	Trojan.TR/AVI.Agent.szlzy
McAfeeD	ti!9D019136CB08
CTX	exe.hacktool.msil
Sophos	Generic Reputation PUA (PUA)
Webroot	W32.Hack.Tool
Google	Detected
Avira	TR/AVI.Agent.szlzy
Antiy-AVL	HackTool/MSIL.Agent
ViRobot	HackTool.S.PortTran.6656
Varist	W32/ABApplication.GGLT-2104
AhnLab-V3	HackTool/Win.PortTran.R544492
McAfee	RDN/Generic PUP.z
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2336403656
Panda	Trj/RnkBend.A
TrendMicro-HouseCall	TROJ_GEN.R002H06A324
Tencent	Malware.Win32.Gencirc.141d4264
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware [Misc]
alibabacloud	Proxytool:Win/WSTunnel

c.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All