Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 8, 2021, 7:21 a.m.	April 8, 2021, 7:24 a.m.

Size	737.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`85721567263e6e9c268437b429f85bbd`
SHA256	`8fdae191f23e076286e8fcb8715836b1973c3937efaa58c886e1f4250cea289d`
CRC32	`BA1280A7`
ssdeep	`12288:DAGlS+yzscOPKzJrpgHLxwYQ4vqj20FKivfX34+HQNVx+Y:EGlbhIzeLw4S2ELnoes`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check

7GsbE2ABGiKVr6O.exe "C:\Users\test22\AppData\Local\Temp\7GsbE2ABGiKVr6O.exe"
9068
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp"
  4960
- 7GsbE2ABGiKVr6O.exe "{path}"
  4024

Name	Response	Post-Analysis Lookup
shahzad73.ddns.net	A 79.134.225.9	79.134.225.9
shahzad73.casacam.net	A 79.134.225.9	79.134.225.9

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
79.134.225.9	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 8, 2021, 7:22 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 8, 2021, 7:21 a.m.			0	0
IsDebuggerPresent April 8, 2021, 7:21 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 8, 2021, 7:22 a.m.	buffer: SUCCESS: The scheduled task "Updates\SlodsS" has successfully been created. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 8, 2021, 7:21 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

shahzad73.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:21 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00beb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0bd20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0bd21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0bd22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 4024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

7GsbE2ABGiKVr6O.exe tried to sleep 352 seconds, actually delayed analysis time by 352 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\SlodsS.exe

Creates a suspicious process (2 events)

cmdline	schtasks.exe /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\SlodsS.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 8, 2021, 7:22 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000b7a00', u'virtual_address': u'0x00002000', u'entropy': 7.522366627674373, u'name': u'.text', u'virtual_size': u'0x000b78d4'}

entropy

7.52236662767

description

A section with a high entropy has been found

entropy

0.997284453496

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 8, 2021, 7:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (27 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Listen for incoming communication	rule	network_tcp_listen
description	File downloader/dropper	rule	network_dropper
description	Communications over RAW socket	rule	network_tcp_socket
description	Escalade priviledges	rule	escalate_priv
description	Run a keylogger	rule	keylogger
description	Record Audio	rule	sniff_audio
description	Steal Firefox credential	rule	cred_ff
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	browser info stealer	rule	infoStealer_browser_Zero
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 94460ef544986b59f2f49e8d235bab8ad24d9f94

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 4024 region_size: 135168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000394	1	0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 4024 process_handle: 0x00000394	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA April 8, 2021, 7:22 a.m.	thread_identifier: 0 callback_function: 0x004052ba hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000	1	69599879	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 9068 called NtSetContextThread to modify thread in remote process 4024
NtSetContextThread April 8, 2021, 7:22 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4276132 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000398 process_identifier: 4024	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 9068 resumed a thread in remote process 4024
NtResumeThread April 8, 2021, 7:22 a.m.	thread_handle: 0x00000398 suspend_count: 1 process_identifier: 4024	1	0	0

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Agent.EWC
FireEye	Generic.mg.85721567263e6e9c
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/starter.ali1000139
K7GW	Trojan ( 0057a4f71 )
Cyren	W32/MSIL_Kryptik.DTU.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.AAIA
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Paloalto	generic.ml
Rising	Trojan.Kryptik!8.8 (CLOUD)
McAfee-GW-Edition	BehavesLike.Win32.Fareit.bc
Microsoft	Trojan:MSIL/CryptInject!MSR
Cynet	Malicious (score: 100)
McAfee	RDN/Generic PWS.y
Malwarebytes	Malware.AI.2222509812
Tencent	Win32.Trojan.Inject.Auto
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agensla.AYU!tr
Webroot	W32.Trojan.Gen
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/TrojanSpy.AgentTesla.HwMAbXsA

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
NtResumeThread April 8, 2021, 7:21 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 9068	1	0
NtResumeThread April 8, 2021, 7:21 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 9068	1	0
NtResumeThread April 8, 2021, 7:21 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 9068	1	0
NtResumeThread April 8, 2021, 7:22 a.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 9068	1	0
NtGetContextThread April 8, 2021, 7:22 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread April 8, 2021, 7:22 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread April 8, 2021, 7:22 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 9068	1	0
CreateProcessInternalW April 8, 2021, 7:22 a.m.	thread_identifier: 3660 thread_handle: 0x000003d4 process_identifier: 4960 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SlodsS" /XML "C:\Users\test22\AppData\Local\Temp\tmp7C77.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003dc	1	1
CreateProcessInternalW April 8, 2021, 7:22 a.m.	thread_identifier: 4384 thread_handle: 0x00000398 process_identifier: 4024 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\7GsbE2ABGiKVr6O.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\7GsbE2ABGiKVr6O.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000394	1	1
NtGetContextThread April 8, 2021, 7:22 a.m.	thread_handle: 0x00000398	1	0
NtAllocateVirtualMemory April 8, 2021, 7:22 a.m.	process_identifier: 4024 region_size: 135168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000394	1	0
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: base_address: 0x00400000 process_identifier: 4024 process_handle: 0x00000394	1	1
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: base_address: 0x00401000 process_identifier: 4024 process_handle: 0x00000394	1	1
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: base_address: 0x00415000 process_identifier: 4024 process_handle: 0x00000394	1	1
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: base_address: 0x0041b000 process_identifier: 4024 process_handle: 0x00000394	1	1
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: base_address: 0x0041d000 process_identifier: 4024 process_handle: 0x00000394	1	1
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: base_address: 0x0041e000 process_identifier: 4024 process_handle: 0x00000394	1	1
WriteProcessMemory April 8, 2021, 7:22 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 4024 process_handle: 0x00000394	1	1
NtSetContextThread April 8, 2021, 7:22 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4276132 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000398 process_identifier: 4024	1	0
NtResumeThread April 8, 2021, 7:22 a.m.	thread_handle: 0x00000398 suspend_count: 1 process_identifier: 4024	1	0
NtResumeThread April 8, 2021, 7:22 a.m.	thread_handle: 0x000003c8 suspend_count: 1 process_identifier: 9068	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (23 events)

dead_host	192.168.56.102:49812
dead_host	192.168.56.102:49827
dead_host	192.168.56.102:49816
dead_host	192.168.56.102:49835
dead_host	79.134.225.9:2404
dead_host	192.168.56.102:49815
dead_host	192.168.56.102:49826
dead_host	192.168.56.102:49819
dead_host	192.168.56.102:49830
dead_host	192.168.56.102:49823
dead_host	192.168.56.102:49834
dead_host	192.168.56.102:49814
dead_host	192.168.56.102:49818
dead_host	192.168.56.102:49825
dead_host	192.168.56.102:49822
dead_host	192.168.56.102:49829
dead_host	192.168.56.102:49833
dead_host	192.168.56.102:49813
dead_host	192.168.56.102:49824
dead_host	192.168.56.102:49817
dead_host	192.168.56.102:49828
dead_host	192.168.56.102:49821
dead_host	192.168.56.102:49832

7GsbE2ABGiKVr6O.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All