Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x3201	March 17, 2021, 6:30 p.m.	March 17, 2021, 6:30 p.m.

Size	23.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`4fa1dbfe022061e6699ae4754b45cb4f`
SHA256	`2d8a94aa729c023228778bd3db76aec6ec015598c8a7e9f79d87b20e2a1c3c3e`
CRC32	`FCA0914A`
ssdeep	`384:5SZm9Hroe51UZgDUeUKQ4rkHi4vHtMc/TnXnJ+IkPsLI8uKS/fJXLgTK:5SZm9LENvHFDXJA0gXJ7`
Yara	PE_Header_Zero - PE File Signature Zero Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description)

Stgedo.exe "C:\Users\Administrator\AppData\Local\Temp\Stgedo.exe"
7956

Name	Response	Post-Analysis Lookup
liverpoolofcfanclub.com	A 104.21.31.39 A 172.67.174.240	104.21.31.39

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.174.240	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 17, 2021, 6:30 p.m.	computer_name: WIN7-PC	1	1	0
GetComputerNameW March 17, 2021, 6:30 p.m.	computer_name: WIN7-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2021, 6:30 p.m.			0	0
IsDebuggerPresent March 17, 2021, 6:30 p.m.			0	0
IsDebuggerPresent March 17, 2021, 6:30 p.m.			0	0
IsDebuggerPresent March 17, 2021, 6:30 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 17, 2021, 6:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048dff0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 6:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048e030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 6:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0048e030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2021, 6:30 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-D9F79B55F8D4D9EC712336B52F5A918A.html

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a152000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 6:30 p.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW March 17, 2021, 6:30 p.m.	newfilepath_r: C:\Users\Administrator\AppData\Local\hjYvcBfKLWEJuSCHqChKTGZUq\Stgedo.exe_Url_gcid2i3byftdmgk331vyehwrxa43hcka\1.508.882.69\user.config flags: 1 oldfilepath_r: C:\Users\Administrator\AppData\Local\hjYvcBfKLWEJuSCHqChKTGZUq\Stgedo.exe_Url_gcid2i3byftdmgk331vyehwrxa43hcka\1.508.882.69\ofupsx1g.newcfg newfilepath: C:\Users\Administrator\AppData\Local\hjYvcBfKLWEJuSCHqChKTGZUq\Stgedo.exe_Url_gcid2i3byftdmgk331vyehwrxa43hcka\1.508.882.69\user.config oldfilepath: C:\Users\Administrator\AppData\Local\hjYvcBfKLWEJuSCHqChKTGZUq\Stgedo.exe_Url_gcid2i3byftdmgk331vyehwrxa43hcka\1.508.882.69\ofupsx1g.newcfg	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 17, 2021, 6:30 p.m.	flags: 15 family: 0		111	0

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.4fa1dbfe022061e6
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 00578e301 )
Alibaba	Trojan:MSIL/Generic.e2e1334a
K7GW	Trojan-Downloader ( 00578e301 )
CrowdStrike	win/malicious_confidence_70% (W)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
Paloalto	generic.ml
McAfee-GW-Edition	RDN/Generic.grp
Emsisoft	Trojan-Downloader.Agent (A)
SentinelOne	Static AI - Malicious PE
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HNH
Avira	TR/Dldr.Agent.opquo
eGambit	Unsafe.AI_Score_97%
Microsoft	Program:Win32/Wacapew.C!ml
AegisLab	Trojan.Win32.Malicious.4!c
GData	Win32.Trojan.Agent.MGA5D0
Cynet	Malicious (score: 90)
McAfee	RDN/Generic.grp
Malwarebytes	Trojan.Downloader.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002H0CCB21
Fortinet	MSIL/Agent.HNH!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34608.bm0@a0syq4mi
AVG	Win32:RATX-gen [Trj]
Qihoo-360	Win32/Backdoor.Rat.HgIASQYA

Stgedo.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All