Report - ZeroBOX

ScreenShot


Created	2021.05.31 09:32	Machine	s1_win7_x6401
Filename	ccsetup579.exe
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score	10	Behavior Score	10.4
ZERO API	file : malware
VT API (file)	42 detected (malicious, high confidence, GenericKD, GenericRXOR, Save, Kryptik, Eldorado, Attribute, HighConfidence, AAQQ, Seraph, MalwareX, Static AI, Suspicious PE, lwnhr, ai score=100, kcloud, AgentTesla, score, R002H0CES21, CLOUD, Unsafe, 100%, ZemsilCO, Cm0@a8vefTd, confidence, susgen)
md5	195eecffa8cb3f26eb11eb4aa379eaf6
sha256	9a5565b8e591a7bda1d7a8824c67e37c36933e056fba84c5e454ebd90d1b248f
ssdeep	12288:TB4W52TiGu7YTxuBs2Nq0zq4t94XJi1tr:l2Ob7YTxuCeX1n4M1x
imphash	f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy	3:rGsLdAIEK:tf

Network IP location

Level	Description
danger	File has been identified by 42 AntiVirus engines on VirusTotal as malicious
danger	Executed a process and injected code into it
watch	Allocates execute permission to another process indicative of possible code injection
watch	Code injection by writing an executable or DLL to the memory of another process
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	The process powershell.exe wrote an executable file to disk
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a shortcut to an executable file
notice	Creates a suspicious process
notice	Creates hidden or system file
notice	Drops an executable to the user AppData folder
notice	One or more potentially interesting buffers were extracted
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	One or more processes crashed
info	Queries for the computername
info	Uses Windows APIs to generate a cryptographic key

Level	Name	Description	Collection
watch	Antivirus	Contains references to security software	binaries (download)
watch	Network_Downloader	File Downloader	memory
notice	Code_injection	Code injection with CreateRemoteThread in a remote process	memory
notice	Network_DNS	Communications use DNS	memory
notice	Network_HTTP	Communications over HTTP	memory
notice	Network_TCP_Socket	Communications over RAW Socket	memory
notice	ScreenShot	Take ScreenShot	memory
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	Is_DotNET_EXE	(no description)	binaries (download)
info	Is_DotNET_EXE	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (download)
info	IsPE32	(no description)	binaries (upload)
info	PE_Header_Zero	PE File Signature	binaries (download)
info	PE_Header_Zero	PE File Signature	binaries (upload)
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	Win_Backdoor_AsyncRAT_Zero	Win Backdoor AsyncRAT	binaries (download)
info	Win_Backdoor_AsyncRAT_Zero	Win Backdoor AsyncRAT	binaries (upload)

Request	CC	ASN Co	IP4	Rule ?	ZERO ?

IAT(Import Address Table) Library

mscoree.dll
0x402000 _CorExeMain

EAT(Export Address Table) is none

Report - ccsetup579.exe