popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

winlog2.exe

Generic Malware
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 15, 2021, 4:58 p.m. March 15, 2021, 5 p.m.
Size 154.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 d06fb902ada1dcc76a186526c8db519b
SHA256 dff67ae0837d545f7f7f553f09ef3c1aa7dbe3674188cecda3e18e214a79b483
CRC32 D6A75566
ssdeep 3072:rPKubXVLcIcEYcyMXrvp7hduCAlFyvRJlcGRprOr8aqhGn8CQZ0Kip0Yt:rPKyLLLXrv4KvRPN7OrzWtZFip0Yt
Yara
  • PE_Header_Zero - PE File Signature Zero
  • Generic_Malware_Zero - Generic Malware
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_private_profile - Affect private profile
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • IsPacked - Entropy Check
  • HasOverlay - Overlay Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
seafirst-kr.com
A 52.6.206.192
52.6.206.192
IP Address Status Action
164.124.101.2 Active Moloch
52.6.206.192 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features POST method with no referer header, HTTP version 1.0 used suspicious_request POST http://seafirst-kr.com/zoro/zoro5/fre.php
request POST http://seafirst-kr.com/zoro/zoro5/fre.php
request POST http://seafirst-kr.com/zoro/zoro5/fre.php
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
file C:\Users\test22\AppData\Local\Temp\nsn6338.tmp\u8nbv.dll
file C:\Users\test22\AppData\Local\Temp\nsn6338.tmp\u8nbv.dll
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001e8
process_name: taskhost.exe
process_identifier: 2984
1 1 0

Process32NextW

 snapshot_handle: 0x000001e8
process_name: winlog2.exe
process_identifier: 2648
1 1 0
url http://purl.org/rss/1.0/
url http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url http://nsis.sf.net/NSIS_Error
url http://www.passport.com
url http://www.ibsensoftware.com/
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Hijack network configuration rule hijack_network
description Create a windows service rule create_service
description Create a COM server rule create_com_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Process injection Process 2648 called NtSetContextThread to modify thread in remote process 2428
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000021c
process_identifier: 2428
1 0 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Barys.112835
FireEye Generic.mg.d06fb902ada1dcc7
ALYac Gen:Variant.Barys.112835
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Alibaba Backdoor:Win32/Androm.91f3d7cb
K7GW Trojan ( 005790e61 )
CrowdStrike win/malicious_confidence_80% (W)
Cyren W32/Injector.AFV.gen!Eldorado
Symantec ML.Attribute.HighConfidence
TrendMicro-HouseCall TROJ_GEN.R002H0CCC21
Avast Win32:InjectorX-gen [Trj]
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Gen:Variant.Barys.112835
Paloalto generic.ml
APEX Malicious
Ad-Aware Gen:Variant.Barys.112835
Emsisoft Gen:Variant.Barys.112835 (B)
DrWeb Trojan.PWS.Siggen2.62814
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Vopak.cc
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Injector
ESET-NOD32 a variant of Win32/Injector.EOVH
Avira TR/AD.LokiBot.btkar
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Trojan:Win32/AgentTesla.PC!MTB
Gridinsoft Trojan.Win32.Downloader.oa
AegisLab Trojan.Win32.Androm.m!c
GData Gen:Variant.Barys.112835
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Nsis.C4371168
McAfee RDN/Generic.cf
MAX malware (ai score=100)
Malwarebytes Trojan.Dropper.NSIS
Rising Trojan.Injector!8.C4 (CLOUD)
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.AFS!tr
AVG Win32:InjectorX-gen [Trj]
Cybereason malicious.25fd2c
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.LokiBot.HoMASQsA