Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x3201	March 17, 2021, 11:13 p.m.	March 17, 2021, 11:13 p.m.

Size	55.2KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b91ce14fbeb12ab2233d195a4c71cd33`
SHA256	`0e4915d612b1d930e773f70acc9f86c0263a86e5103d0ac52fc892db0a899e8c`
CRC32	`BD66A74C`
ssdeep	`768:nSrNa1MZ89fO8pn+CPYXW7tPJajWA6Z5JKZ3Ry/yFtlLT6DZ9QRJGfMFYVGflvxY:neNa1MZ89fO8JVPYmRQjB+kge7Tgj`
Yara	PE_Header_Zero - PE File Signature Zero Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check

updateandr.txt "C:\Users\Administrator\AppData\Local\Temp\updateandr.txt"
4068

Name	Response	Post-Analysis Lookup
liverpoolofcfanclub.com	A 104.21.31.39 A 172.67.174.240	172.67.174.240

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.174.240	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 17, 2021, 11:10 p.m.	computer_name: WIN7-PC	1	1	0
GetComputerNameW March 17, 2021, 11:10 p.m.	computer_name: WIN7-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2021, 11:10 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:10 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:10 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:10 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 17, 2021, 11:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8b78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8bb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8bb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2021, 11:10 p.m.		1	1	0

Performs some HTTP requests (3 events)

request	GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-94F0D464E713936751E4AD4ADA929BC3.html
request	GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-353AADFFA5A9D10A6A4795C11E4659D8.html
request	GET http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C02B4706036B3BA6A7232CEC8A09625.html

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70722000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9f2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c1ab000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a3b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a3b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bf7a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00605000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00607000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70daf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75eb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70d55000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75661000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77651000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75791000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75341000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f541000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77681000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71e91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75301000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754e1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:10 p.m.	process_identifier: 4068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bd1000 process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 17, 2021, 11:10 p.m.	flags: 15 family: 0		111	0

updateandr.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All