Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 31, 2021, 10:25 a.m.	March 31, 2021, 10:31 a.m.

Size	279.0KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`83e6a0bec752cfa12db166b45ba49a79`
SHA256	`f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f`
CRC32	`1588EA45`
ssdeep	`6144:11jPZmG29u87HxpEyp2SNj91keVmvOC/OXcG26EqKXfV2ldUJR94VcTAgmQ:nZdMRp70SNj91ke4Om1YVld8T4VA`
Yara	PE_Header_Zero - PE File Signature Zero anti_vm_detect - Possibly employs anti-virtualization techniques IsPE64 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check ImportTableIsBad - ImportTable Check HasRichSignature - Rich Signature Check

ret1.exe "C:\Users\test22\AppData\Local\Temp\ret1.exe"
5904

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 31, 2021, 10:23 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 35942096 registers.r15: 36855268 registers.rcx: 1998486160 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1998486160 registers.rsp: 10544520 registers.r11: 1999397528 registers.r8: 64 registers.r9: 10544728 registers.rdx: 64 registers.r12: 36862958 registers.rbp: 10544784 registers.rdi: 35782720 registers.rax: 0 registers.r13: 64	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ed5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e52000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e49000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ec9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e42000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e51000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e49000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e57000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ea1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ea2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076eb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ecf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e41000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e42000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:23 a.m.	process_identifier: 5904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

FireEye	Generic.mg.83e6a0bec752cfa1
Cylance	Unsafe
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
CrowdStrike	win/malicious_confidence_60% (W)

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

ret1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All