popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

toolspab1.exe

Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug OS Processor Check PE32 PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 25, 2022, 5:34 p.m. Feb. 25, 2022, 5:44 p.m.
Size 330.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 74237f2f009020c7bfe80f274a049843
SHA256 328a6537dfd9065ccb7579cda5877e452fd6b147dfbe80d13754f0635bbee6eb
CRC32 28593D70
ssdeep 3072:aQ7i8yKVLyl+DeERhcybKXVxArVyBjuIN9N4fWrPMMW5zDYJOXUnnOPeGyJ5tNo1:6p+DeEzNbvVyBju89NFrPmXUOPArgY
PDB Path C:\gecotaro wafuxahegun88-cicuyexul hohefu_mazi\pekewo\vakay\s.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • Trojan_DarkSide_Ransomware_1_Zero - Darkside Ransomware
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path C:\gecotaro wafuxahegun88-cicuyexul hohefu_mazi\pekewo\vakay\s.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f1c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2772
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02de0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
name RT_STRING language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02707a28 size 0x00000128
name RT_STRING language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02707a28 size 0x00000128
name RT_STRING language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02707a28 size 0x00000128
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027056a0 size 0x00000020
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027056a0 size 0x00000020
name RT_GROUP_CURSOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073c8 size 0x00000014
name RT_GROUP_CURSOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073c8 size 0x00000014
name RT_GROUP_CURSOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073c8 size 0x00000014
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02705678 size 0x00000022
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02705678 size 0x00000022
name RT_VERSION language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073e0 size 0x00000130
section {u'size_of_data': u'0x00010a00', u'virtual_address': u'0x00026000', u'entropy': 7.797815072265064, u'name': u'.data', u'virtual_size': u'0x026d8560'} entropy 7.79781507227 description A section with a high entropy has been found
entropy 0.202127659574 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2872
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2872
process_handle: 0x00000080
1 1 0
Process injection Process 2772 called NtSetContextThread to modify thread in remote process 2872
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206407
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2872
1 0 0
Process injection Process 2772 resumed a thread in remote process 2872
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2872
1 0 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.74237f2f009020c7
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.4e3dde
Baidu Win32.Trojan.Kryptik.jm
Cyren W32/Injuke.O.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
ClamAV Win.Dropper.Generickdz-9939781-0
Kaspersky VHO:Trojan-PSW.Win32.Convagent.gen
McAfee-GW-Edition BehavesLike.Win32.Packed.fm
Trapmine suspicious.low.ml.score
Sophos ML/PE-A + Troj/Krypt-FV
Ikarus Trojan-Ransom.StopCrypt
Microsoft Ransom:Win32/StopCrypt!ml
Acronis suspicious
McAfee Packed-GEE!74237F2F0090
VBA32 BScope.Backdoor.Mokes
Malwarebytes Trojan.MalPack.GS
Rising Malware.Obscure/Heur!1.9E03 (CLASSIC)
SentinelOne Static AI - Malicious PE
eGambit Generic.Malware
CrowdStrike win/malicious_confidence_70% (D)
MaxSecure Trojan.Malware.300983.susgen
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2876
thread_handle: 0x0000007c
process_identifier: 2872
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\toolspab1.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\toolspab1.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\toolspab1.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2872
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2872
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2872
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206407
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2872
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2872
1 0 0