Report - ZeroBOX

ScreenShot

Info
Location map


Created	2021.03.17 23:48	Machine	s1_win7_x6401
Filename	28.casacapitale.exe
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score	6	Behavior Score	7.6
ZERO API	file : malware
VT API (file)	32 detected (Zusy, malicious, confidence, Kryptik, HJZA, Trickster, TRICKBOT, YABCOT, Krypt, jfgje, ai score=80, score, GenKryptik, CLOUD, FCYD, GdSda, TrojanPSW, HgkASQ0A)
md5	5b94175e4686d1615628f78a623bcead
sha256	9118198afca6e2479fdbcca55a08a4408570d2186a7dd8f261f1821178deb595
ssdeep	12288:sFq5gJqjDe8jUCYPnXjX/5n85pFb85uX8KelP4ukZN0WrIUAJi2:I0+jXBnApFoS8iukJMUW7
imphash	cae73998be5b008dd1c2d777a562de39
impfuzzy	96:Qt+62EOdVGmvpo14ltV4DsapCteMg2QdNdi1U9u4cpcRcLGoaoF95gz:X60RZ2smCteMg2QdHi1U9u4cpcRcdYz

Network IP location

Signature (18cnts)

Level	Description
danger	File has been identified by 32 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	A process attempted to delay the analysis task.
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a suspicious process
notice	Creates hidden or system file
notice	Looks up the external IP address
notice	One or more potentially interesting buffers were extracted
notice	Performs some HTTP requests
notice	Potentially malicious URLs were found in the process memory dump
notice	Terminates another process
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	Queries for the computername

Rules (57cnts)

Level	Name	Description	Collection
danger	Win32_Trojan_Emotet_1_Zero	Win32 Trojan Emotet	binaries (upload)
danger	Win32_Trojan_Gen_1_0904B0_Zero	Win32 Trojan Emotet	binaries (upload)
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	antisb_threatExpert	Anti-Sandbox checks for ThreatExpert	memory
info	Check_Dlls	(no description)	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerCheck__RemoteAPI	(no description)	memory
info	DebuggerException__ConsoleCtrl	(no description)	memory
info	DebuggerException__SetConsoleCtrl	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	IsDLL	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (upload)
info	OS_Processor_Check_Zero	OS Processor Check Signature Zero	binaries (upload)
info	PE_Header_Zero	PE File Signature Zero	binaries (upload)
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	create_com_service	Create a COM server	memory
info	create_service	Create a windows service	memory
info	cred_local	Steal credential	memory
info	escalate_priv	Escalade priviledges	memory
info	HasRichSignature	Rich Signature Check	binaries (upload)
info	inject_thread	Code injection with CreateRemoteThread in a remote process	memory
info	IsPacked	Entropy Check	binaries (upload)
info	IsWindowsGUI	(no description)	binaries (upload)
info	keylogger	Run a keylogger	binaries (upload)
info	keylogger	Run a keylogger	memory
info	migrate_apc	APC queue tasks migration	memory
info	network_dga	Communication using dga	memory
info	network_dns	Communications use DNS	memory
info	network_dropper	File downloader/dropper	memory
info	network_ftp	Communications over FTP	memory
info	network_http	Communications over HTTP	memory
info	network_p2p_win	Communications over P2P network	memory
info	network_tcp_listen	Listen for incoming communication	memory
info	network_tcp_socket	Communications over RAW socket	memory
info	network_udp_sock	Communications over UDP network	memory
info	screenshot	Take screenshot	binaries (upload)
info	screenshot	Take screenshot	memory
info	sniff_audio	Record Audio	memory
info	spreading_file	Malware can spread east-west file	memory
info	spreading_share	Malware can spread east-west using share drive	memory
info	Str_Win32_Wininet_Library	Match Windows Inet API library declaration	memory
info	Str_Win32_Winsock2_Library	Match Winsock 2 API library declaration	memory
info	win_files_operation	Affect private profile	binaries (upload)
info	win_files_operation	Affect private profile	memory
info	win_mutex	Create or check mutex	memory
info	win_private_profile	Affect private profile	binaries (upload)
info	win_private_profile	Affect private profile	memory
info	win_registry	Affect system registries	binaries (upload)
info	win_registry	Affect system registries	memory
info	win_token	Affect system token	memory

Network (7cnts) ?

Request	ASN Co	IP4	ZERO ?
http://checkip.amazonaws.com/ whois	AMAZON-AES	52.204.109.97	clean
150.134.208.175.b.barracudacentral.org whois		127.0.0.2	clean
checkip.amazonaws.com whois	AMAZON-AES	52.204.109.97	clean
150.134.208.175.cbl.abuseat.org whois			clean
150.134.208.175.zen.spamhaus.org whois			clean
23.21.27.29 whois	AMAZON-AES	23.21.27.29	clean
131.255.106.152 whois	The Houses Television C.A. (ConexTELECOM)	131.255.106.152	mailcious

Report - 28.casacapitale.exe

Signature (18cnts)

Rules (57cnts)

Network (7cnts) ?

Suricata ids

Similarity measure (PE file only) - Checking for service failure