Report - ZeroBOX

ScreenShot


Created	2023.06.08 09:28	Machine	s1_win7_x6403
Filename	YY.exe
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
AI Score	7	Behavior Score	9.4
ZERO API	file : malware
VT API (file)	28 detected (Remcos, malicious, high confidence, Save, confidence, Attribute, HighConfidence, Kryptik, AHED, score, TrojanX, Wylw, AGEN, Static AI, Malicious PE, Sabsik, Detected, Artemis, unsafe, MSIL@AI, MSIL2, rFp2idg6bjPQytmJeMPy4Q, DarkCloud, susgen)
md5	5a01a667c84893b0ab403b39b3c73b53
sha256	c296470f0a24955e74c6695312974b6f7b32b89147368e84804b47f76d5befa3
ssdeep	12288:eN44r9HYXzdEXVDBbupm9PwbZxCMhrI5cRdbtF9fgdm1ttt:u9GeXVDmeYFM5cRdJ
imphash
impfuzzy	3::

Network IP location

Level	Description
danger	Executed a process and injected code into it
warning	File has been identified by 28 AntiVirus engines on VirusTotal as malicious
watch	Allocates execute permission to another process indicative of possible code injection
watch	Code injection by writing an executable or DLL to the memory of another process
watch	Communicates with host for which no DNS query was performed
watch	Manipulates memory of a non-child process indicative of process injection
watch	Potential code injection by writing to the memory of another process
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
notice	A process attempted to delay the analysis task.
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Connects to a Dynamic DNS Domain
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	One or more potentially interesting buffers were extracted
notice	Performs some HTTP requests
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	Collects information to fingerprint the system (MachineGuid
info	This executable has a PDB path

Level	Name	Description	Collection
warning	infoStealer_browser_Zero	browser info stealer	memory
watch	Chrome_User_Data_Check_Zero	Google Chrome User Data Check	memory
watch	ConfuserEx_Zero	Confuser .NET	binaries (upload)
watch	Network_Downloader	File Downloader	memory
notice	Create_Service	Create a windows service	memory
notice	Escalate_priviledges	Escalate priviledges	memory
notice	Generic_PWS_Memory_Zero	PWS Memory	memory
notice	KeyLogger	Run a KeyLogger	memory
notice	Network_DNS	Communications use DNS	memory
notice	Network_TCP_Socket	Communications over RAW Socket	memory
notice	ScreenShot	Take ScreenShot	memory
notice	Sniff_Audio	Record Audio	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	IsPE64	(no description)	binaries (upload)
info	PE_Header_Zero	PE File Signature	binaries (upload)
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	Win_Backdoor_AsyncRAT_Zero	Win Backdoor AsyncRAT	binaries (upload)
info	Win_Trojan_agentTesla_Zero	Win.Trojan.agentTesla	memory

Request	ASN Co	IP4	ZERO ?
http://geoplugin.net/json.gp whois	Schuberg Philis B.V.	178.237.33.50	clean
geoplugin.net whois	Schuberg Philis B.V.	178.237.33.50	clean
pekonomiana.duckdns.org whois	Global Layer B.V.	134.19.179.211	clean
178.237.33.50 whois	Schuberg Philis B.V.	178.237.33.50	clean
61.111.58.40 whois	LG DACOM Corporation	61.111.58.40	clean
104.76.70.102 whois	Akamai International B.V.	104.76.70.102	clean
134.19.179.211 whois	Global Layer B.V.	134.19.179.211	clean

IAT(Import Address Table) is none

EAT(Export Address Table) is none

Report - YY.exe