Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 30, 2021, 10:50 a.m.	March 30, 2021, 11:04 a.m.

Size	280.5KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`cdd95ff38e182507086b604b395c5131`
SHA256	`42edefa09a3d85a3d4284f6ef57691c8b409ac00da21c799ae14b1adf17435f0`
CRC32	`4E8B4B5E`
ssdeep	`6144:5RdcItrldgXTU4G0C2vg9QAJtn98PwuK3tTX+gGELCg4:5QuxaTdAJx98PwuKdXbGEO`
Yara	PE_Header_Zero - PE File Signature Zero IsPE64 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

ret5ret3.exe "C:\Users\test22\AppData\Local\Temp\ret5ret3.exe"
4356

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 30, 2021, 10:42 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 35155664 registers.r15: 36068836 registers.rcx: 1998486160 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 34996288 registers.rsp: 32694408 registers.r11: 1999397528 registers.r8: 64 registers.r9: 32694616 registers.rdx: 64 registers.r12: 36076526 registers.rbp: 32694672 registers.rdi: 1998486160 registers.rax: 64 registers.r13: 36060336	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ed5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e52000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e49000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ec9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e42000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e51000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e49000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e57000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ea1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ea2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076eb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ecf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e41000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e42000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 30, 2021, 10:42 a.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.1672fc
APEX	Malicious
Avast	Win64:MalwareX-gen [Trj]
Paloalto	generic.ml
Rising	Trojan.Fuerboos!8.EFC8 (CLOUD)
McAfee-GW-Edition	BehavesLike.Win64.Generic.dt
Microsoft	Trojan:Win32/Fuerboos.B!cl
Cynet	Malicious (score: 100)
McAfee	Artemis!CDD95FF38E18
AVG	Win64:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win64/Trojan.Generic.HgEASRwA

ret5ret3.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All