Report - ZeroBOX

ScreenShot


Created	2021.09.30 09:32	Machine	s1_win7_x6402
Filename	ABG.exe
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score	9	Behavior Score	12.2
ZERO API	file : clean
VT API (file)	14 detected (malicious, high confidence, Unsafe, Kryptik, Eldorado, Attribute, HighConfidence, ACYQ, Agensla, Static AI, Malicious PE, Sabsik, score, ACYI, confidence, 100%)
md5	d51f8036b14a72ad278e0c0d1202ebbe
sha256	cf6ce67191cc8560c728cef61aa68026540656dc1eb22ce646fc67280bbb7316
ssdeep	24576:8D4VHfQe6ZyWshg+qbZxTZZWunAWvGPSg0Q0ctsT0h0acLJfLWaJHCZ/L:cmag0Q0ctGa2f71eL
imphash	f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy	3:rGsLdAIEK:tf

Network IP location

Level	Description
danger	The process wscript.exe wrote an executable file to disk which it then attempted to execute
danger	Executed a process and injected code into it
watch	Allocates execute permission to another process indicative of possible code injection
watch	Code injection by writing an executable or DLL to the memory of another process
watch	Creates a windows hook that monitors keyboard input (keylogger)
watch	File has been identified by 14 AntiVirus engines on VirusTotal as malicious
watch	Installs itself for autorun at Windows startup
watch	One or more non-whitelisted processes were created
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
watch	Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice	A process attempted to delay the analysis task.
notice	A process created a hidden window
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Connects to a Dynamic DNS Domain
notice	Creates a suspicious process
notice	Creates executable files on the filesystem
notice	Drops a binary and executes it
notice	One or more potentially interesting buffers were extracted
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	One or more processes crashed

Level	Name	Description	Collection
warning	Generic_Malware_Zero	Generic Malware	binaries (upload)
warning	infoStealer_browser_Zero	browser info stealer	memory
watch	Chrome_User_Data_Check_Zero	Google Chrome User Data Check	memory
watch	Network_Downloader	File Downloader	memory
watch	Win32_Trojan_PWS_Net_1_Zero	Win32 Trojan PWS .NET Azorult	binaries (upload)
notice	Code_injection	Code injection with CreateRemoteThread in a remote process	memory
notice	Create_Service	Create a windows service	memory
notice	Escalate_priviledges	Escalate priviledges	memory
notice	KeyLogger	Run a KeyLogger	memory
notice	Network_TCP_Socket	Communications over RAW Socket	memory
notice	Sniff_Audio	Record Audio	memory
info	anti_dbg	Checks if being debugged	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	Is_DotNET_EXE	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (upload)
info	PE_Header_Zero	PE File Signature	binaries (upload)
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	Win_Trojan_agentTesla_Zero	Win.Trojan.agentTesla	memory

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
jamaru1444.myftp.biz whois		VIETNAM POSTS AND TELECOMMUNICATIONS GROUP	103.133.111.149		clean
103.133.111.149 whois		VIETNAM POSTS AND TELECOMMUNICATIONS GROUP	103.133.111.149		malware

IAT(Import Address Table) Library

mscoree.dll
0x402000 _CorExeMain

EAT(Export Address Table) is none

Report - ABG.exe