Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 17, 2021, 11:09 p.m.	March 17, 2021, 11:09 p.m.

Size	621.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`1bf3028a0b65a4174a66f3677e872026`
SHA256	`619393d5caf08cf12e3e447e71b139a064978216122e40f769ac8838a7edfca4`
CRC32	`24B77C3C`
ssdeep	`12288:nTcqwHtDnDnP5qLKRKd7LE8M/vBD4pa1OWxd1Ysblvd6Q3kW7743kG1isitWi:nTcqwHtDnDnP5qLKRKBL3uvd4TWf1Ys3`
PDB Path	D:\TEST\9f789s7
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

26a5.txt "C:\Users\test22\AppData\Local\Temp\26a5.txt"
7388
- 26a5.txt "C:\Users\test22\AppData\Local\Temp\26a5.txt"
  232

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

D:\TEST\9f789s7

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 7388 region_size: 10006528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01130000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 3ab3cdf92210f9caff930be38ddac5fc1297c3b5

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 232 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000044	1	0	0

Detects Avast Antivirus through the presence of a library (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle March 17, 2021, 11:09 p.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle March 17, 2021, 11:09 p.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 232 process_handle: 0x00000044	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7388 called NtSetContextThread to modify thread in remote process 232
NtSetContextThread March 17, 2021, 11:09 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4206024 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000040 process_identifier: 232	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7388 resumed a thread in remote process 232
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000040 suspend_count: 1 process_identifier: 232	1	0	0

Executed a process and injected code into it, probably while unpacking (8 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 17, 2021, 11:09 p.m.	thread_identifier: 4748 thread_handle: 0x00000040 process_identifier: 232 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\26a5.txt" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000044	1	1
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000040	1	0
NtUnmapViewOfSection March 17, 2021, 11:09 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 232 process_handle: 0x00000044	1	0
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 232 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000044	1	0
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: base_address: 0x00400000 process_identifier: 232 process_handle: 0x00000044	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 232 process_handle: 0x00000044	1	1
NtSetContextThread March 17, 2021, 11:09 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4206024 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000040 process_identifier: 232	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000040 suspend_count: 1 process_identifier: 232	1	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Zusy.3110
FireEye	Generic.mg.1bf3028a0b65a417
CAT-QuickHeal	Trojan.FickerRI.S18569813
ALYac	Gen:Variant.Ser.Zusy.3110
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.73990
Sangfor	Trojan.Win32.Conti.GA
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanPSW:Win32/Conti.aaf8533a
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.a0b65a
Arcabit	Trojan.Ser.Zusy.DC26
BitDefenderTheta	Gen:NN.ZexaF.34608.Mq3@aimOq!pc
Cyren	W32/Trojan.EDDA-4555
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/GenKryptik.FAMQ
APEX	Malicious
Avast	Win32:BotX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.Win32.Ficker.gen
BitDefender	Gen:Variant.Ser.Zusy.3110
NANO-Antivirus	Trojan.Win32.Ficker.ijfdwk
Paloalto	generic.ml
ViRobot	Trojan.Win32.Z.Ficker.635904
Tencent	Malware.Win32.Gencirc.11b92137
Ad-Aware	Gen:Variant.Ser.Zusy.3110
Emsisoft	Gen:Variant.Ser.Zusy.3110 (B)
F-Secure	Trojan.TR/AD.Nekark.byhxj
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PBB21
McAfee-GW-Edition	GenericRXNL-IL!1BF3028A0B65
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	TR/AD.Nekark.byhxj
Microsoft	Trojan:Win32/Conti.GA!MTB
AegisLab	Trojan.Win32.Ficker.i!c
ZoneAlarm	HEUR:Trojan-PSW.Win32.Ficker.gen
GData	Gen:Variant.Ser.Zusy.3110
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.Reputation.C4311140
McAfee	GenericRXNL-IL!1BF3028A0B65
MAX	malware (ai score=81)
VBA32	Malware-Cryptor.Inject.gen
Malwarebytes	Spyware.FickerStealer
TrendMicro-HouseCall	TROJ_GEN.R002C0PBB21
Rising	Trojan.Cryptor!8.11DA0 (CLOUD)
Yandex	Trojan.Agent!xeOSHRGpLAs
Ikarus	Trojan.Win32.Krypt
Fortinet	W32/Ficker.FAMQ!tr

26a5.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All