Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 2, 2021, 10:33 a.m.	April 2, 2021, 10:38 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ffe3cce3479bb06607d5056e6dbca530`
SHA256	`079e85bcaa57b334fa9b3debe99c9f0402eb01104c9fdf3811e34e17308d64f0`
CRC32	`3C96C71D`
ssdeep	`24576:tJSOSvjwUkKPw2Xlk6i0IO4oATTEjfRwB5pPuF4hO:tZyPXljIf/uI8F`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero screenshot - Take screenshot

Install_Plugin_x64_x86.exe "C:\Users\test22\AppData\Local\Temp\Install_Plugin_x64_x86.exe"
5628
- RegSvcs.exe "{path}"
  6892

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
86.107.197.200	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 2, 2021, 10:33 a.m.			0	0
IsDebuggerPresent April 2, 2021, 10:33 a.m.			0	0
IsDebuggerPresent April 2, 2021, 10:34 a.m.			0	0
IsDebuggerPresent April 2, 2021, 10:34 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey April 2, 2021, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00596160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005961e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005961e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005962a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005962a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 2, 2021, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00596460 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 2, 2021, 10:33 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 64 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00531000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 10:33 a.m.	process_identifier: 5628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00533000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00534000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00535000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00536000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00537000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00538000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00539000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f502000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 2, 2021, 10:34 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d6600', u'virtual_address': u'0x00002000', u'entropy': 7.841064698102233, u'name': u'.text', u'virtual_size': u'0x000d6574'}

entropy

7.8410646981

description

A section with a high entropy has been found

entropy

0.786697247706

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 2, 2021, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (10 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Take screenshot	rule	screenshot
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Possibly employs anti-virtualization techniques	rule	vmdetect

Terminates another process (6 events)

Time & API	Arguments	Status
NtTerminateProcess April 2, 2021, 10:34 a.m.	status_code: 0xffffffff process_identifier: 6952 process_handle: 0x00000290
NtTerminateProcess April 2, 2021, 10:34 a.m.	status_code: 0xffffffff process_identifier: 6952 process_handle: 0x00000290	1
NtTerminateProcess April 2, 2021, 10:34 a.m.	status_code: 0xffffffff process_identifier: 5640 process_handle: 0x0000029c
NtTerminateProcess April 2, 2021, 10:34 a.m.	status_code: 0xffffffff process_identifier: 5640 process_handle: 0x0000029c	1
NtTerminateProcess April 2, 2021, 10:34 a.m.	status_code: 0xffffffff process_identifier: 4452 process_handle: 0x000002ac
NtTerminateProcess April 2, 2021, 10:34 a.m.	status_code: 0xffffffff process_identifier: 4452 process_handle: 0x000002ac	1

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	86.107.197.200

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6952 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280		3221225496
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5640 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294		3221225496
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 4452 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000298		3221225496
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 2, 2021, 10:34 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Manipulates memory of a non-child process indicative of process injection (6 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 5628 manipulating memory of non-child process 6952
Process injection	Process 5628 manipulating memory of non-child process 5640
Process injection	Process 5628 manipulating memory of non-child process 4452
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6952 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280	3221225496	0
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5640 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294	3221225496	0
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 4452 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000298	3221225496	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELãÈ¶à0´° à@ @4°OàÜ° H.text\° ´ `.rsrcÜà¸@@.relocÀ@B base_address: 0x00400000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: P8hÜàLL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<InternalNameKurbashes.exe(LegalCopyright DOriginalFilenameKurbashes.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ìâêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: °0 base_address: 0x00430000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 6892 process_handle: 0x000002a8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELãÈ¶à0´° à@ @4°OàÜ° H.text\° ´ `.rsrcÜà¸@@.relocÀ@B base_address: 0x00400000 process_identifier: 6892 process_handle: 0x000002a8	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5628 called NtSetContextThread to modify thread in remote process 6892
NtSetContextThread April 2, 2021, 10:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4370566 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002ac process_identifier: 6892	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5628 resumed a thread in remote process 6892
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 6892	1	0	0

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.73750
FireEye	Generic.mg.ffe3cce3479bb066
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	PWS-FCXK!FFE3CCE3479B
CrowdStrike	win/malicious_confidence_60% (D)
Cyren	W32/MSIL_Agent.BGQ.gen!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.AAEH
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-Dropper.MSIL.Dapato.gen
BitDefender	Trojan.GenericKDZ.73750
Ad-Aware	Trojan.GenericKDZ.73750
Sophos	ML/PE-A
DrWeb	Trojan.PWS.Siggen2.63513
McAfee-GW-Edition	PWS-FCXK!FFE3CCE3479B
Emsisoft	Trojan.GenericKDZ.73750 (B)
SentinelOne	Static AI - Malicious PE
eGambit	PE.Heur.InvalidSig
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKDZ.73750
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34662.fn2@aygePEai
MAX	malware (ai score=85)
Malwarebytes	PUP.Optional.DriverPack
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.DMC!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.3479bb
Panda	Trj/GdSda.A

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

86.107.197.200:40355

Executed a process and injected code into it, probably while unpacking (32 events)

Time & API	Arguments	Status	Return
NtResumeThread April 2, 2021, 10:33 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 5628	1	0
NtResumeThread April 2, 2021, 10:33 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 5628	1	0
NtResumeThread April 2, 2021, 10:33 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 5628	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 5628	1	0
NtGetContextThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 5628	1	0
CreateProcessInternalW April 2, 2021, 10:34 a.m.	thread_identifier: 4256 thread_handle: 0x0000027c process_identifier: 6952 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000280	1	1
NtGetContextThread April 2, 2021, 10:34 a.m.	thread_handle: 0x0000027c	1	0
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6952 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280		3221225496
CreateProcessInternalW April 2, 2021, 10:34 a.m.	thread_identifier: 5916 thread_handle: 0x00000290 process_identifier: 5640 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000294	1	1
NtGetContextThread April 2, 2021, 10:34 a.m.	thread_handle: 0x00000290	1	0
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 5640 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294		3221225496
CreateProcessInternalW April 2, 2021, 10:34 a.m.	thread_identifier: 2848 thread_handle: 0x0000029c process_identifier: 4452 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000298	1	1
NtGetContextThread April 2, 2021, 10:34 a.m.	thread_handle: 0x0000029c	1	0
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 4452 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000298		3221225496
CreateProcessInternalW April 2, 2021, 10:34 a.m.	thread_identifier: 5888 thread_handle: 0x000002ac process_identifier: 6892 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002a8	1	1
NtGetContextThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000002ac	1	0
NtAllocateVirtualMemory April 2, 2021, 10:34 a.m.	process_identifier: 6892 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8	1	0
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELãÈ¶à0´° à@ @4°OàÜ° H.text\° ´ `.rsrcÜà¸@@.relocÀ@B base_address: 0x00400000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: base_address: 0x00402000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: P8hÜàLL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<InternalNameKurbashes.exe(LegalCopyright DOriginalFilenameKurbashes.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ìâêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: °0 base_address: 0x00430000 process_identifier: 6892 process_handle: 0x000002a8	1	1
WriteProcessMemory April 2, 2021, 10:34 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 6892 process_handle: 0x000002a8	1	1
NtSetContextThread April 2, 2021, 10:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4370566 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002ac process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 6892	1	0
NtResumeThread April 2, 2021, 10:34 a.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 6892	1	0

Install_Plugin_x64_x86.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All