Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 8, 2021, 9:16 a.m.	April 8, 2021, 9:32 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
MD5	`68e2ff114060c1bfc6d2398b860e70b0`
SHA256	`207be23ccd62d0e3d9aefe12f5c2ab142a42a25b1e246e27e0ae9087c2fe96d3`
CRC32	`4C5651AF`
ssdeep	`24576:t1qUutWByWyDu3XzaPnrC7WdwKL4VP3DQphXEwqIzDD5aZTqSyNBgFKtc+Zs:t1qUuuyWkkL7JmuDQpJeKJaElHgYtds`
Yara	Malicious_Library_Zero - Malicious_Library screenshot - Take screenshot keylogger - Run a keylogger win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasOverlay - Overlay Check HasModified_DOS_Message - DOS Message Check

ya.exe "C:\Users\test22\AppData\Local\Temp\ya.exe"
7960
- dllhost.exe "C:\Windows\System32\dllhost.exe"
  5916
- cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Poi.vsd
  4384
  - cmd.exe C:\Windows\System32\cmd.exe
    8704
    - findstr.exe findstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd
      8168
    - Agli.exe.com Agli.exe.com D
      4884
      - Agli.exe.com C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com D
        9024
        
        Agli.exe.com C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com D
        6596
        
        Agli.exe.com C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com
        5352
        
        cmd.exe cmd.exe /C ver > "C:\Users\test22\AppData\Local\Temp\chrD6EC.tmp"
        8888
        
        cmd.exe cmd.exe /C wmic process get Name > "C:\Users\test22\AppData\Local\Temp\chrD799.tmp"
        7096
        
        WMIC.exe wmic process get Name
        5932
        
        cmd.exe cmd /c makecab /V3 "C:\Users\test22\AppData\Local\Temp\5e65aaa67ea5c920748e191e17645c6a932f8796" "C:\Users\test22\AppData\Local\Temp\chrD96F.tmp"
        4468
        
        makecab.exe makecab /V3 "C:\Users\test22\AppData\Local\Temp\5e65aaa67ea5c920748e191e17645c6a932f8796" "C:\Users\test22\AppData\Local\Temp\chrD96F.tmp"
        1388
    - PING.EXE ping 127.0.0.1 -n 30
      5272

Name	Response	Post-Analysis Lookup
zjZFqZYoOtpryMyR.zjZFqZYoOtpryMyR
banusdoret.top	A 8.208.95.18	8.208.95.18

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
8.208.95.18	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 8, 2021, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 8, 2021, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 8, 2021, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 8, 2021, 9:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 8, 2021, 9:31 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 8, 2021, 9:16 a.m.			0	0
IsDebuggerPresent April 8, 2021, 9:16 a.m.			0	0
IsDebuggerPresent April 8, 2021, 9:16 a.m.			0	0
IsDebuggerPresent April 8, 2021, 9:31 a.m.			0	0

Command line console output was observed (50 out of 1935 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: jYxtKHdYYGBMqUGjqfFCzXkRCLvXESpmGfzZhPyseGOmXCNgECPllN=fNDBYkzzubeuKAGYlphmNoLTqYoaeeYgSBtkKhuuJjIeVvrNXDEwXgwueKBqrqdrmOhpvxgXriPAAIXDUxxmnXdEmXpqLyeIVFDipUdDfHXPnAGzMYuIGRFBbIJmkgkXyiEUyQzqrRpQZAuZsPhNZzetqwKAkRawvZKdWLgWEuEOH console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'jYxtKHdYYGBMqUGjqfFCzXkRCLvXESpmGfzZhPyseGOmXCNgECPllN' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: CWCKicqbYLtAUtyTPjmozZQPeFBsoTOgvkmOYAJWwYwZkvRlQLsagmcCuMHBTIgtXQrJEsUgC=ixXQDGOsBbCcZWQWIjToraJWecaiFnReQMaqEfoqNBiRCBRiSHJHxxmOKqOogGMeGmFjEQaarSxBkSxADlgXPpHvhEfDAqMuPykeVEDefdDCZXDSGhFraOjbRpZZBOSrugMuHsFYHjImFyvfqv console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'CWCKicqbYLtAUtyTPjmozZQPeFBsoTOgvkmOYAJWwYwZkvRlQLsagmcCuMHBTIgtXQrJEsUgC' is not recognized as an internal or external command, operable program or batch fil console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: e. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: hcIOqSOkMFDBAnAcKlblfIGcyuNRMMJZtRFIbAMhTuSztKiqyJMyDkIEOjITyWnqVEvJTRYpbpsoQj=cZMMeZEcSpqTkSSoXHSnAhbihLCHxUmOCVhTapvqspEmSXNsEqxBXORiBEnsbWqYKjsfEZQNkSisJXgdYlezmXQOrysNLtCcoFPGFbMFlHdyGAbDfozjTGnM console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'hcIOqSOkMFDBAnAcKlblfIGcyuNRMMJZtRFIbAMhTuSztKiqyJMyDkIEOjITyWnqVEvJTRYpbpsoQj' is not recognized as an internal or external command, operable program or batc console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: h file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: DjnHewufMotoIKAbbpSHLiDIObCKfBBurlekhYoFpPUszcHnSOcbGyKvIQTEmc=lGXynHflnwhbWjjgaQtSBytAXAGCbyDuNPKKvdoQDEXvaHNpvBANxDntCviXwMMzbiKiBBSeHgfWoIodMvuVEPLpdGoZokPQREYkWGHUJnuugBVTgQlEFROHcAQVzTTvmnyEJWzuOjjyJFVOKgKaqllqQsPvPMBPFJGPvspsbtPzFIXQEwltoBvggtNaiXdeKvAqYus console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'DjnHewufMotoIKAbbpSHLiDIObCKfBBurlekhYoFpPUszcHnSOcbGyKvIQTEmc' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: tzUWcQcizZROCbHthaAaDRlmONIoiXRnKRZPGmTbJGZoyCAhOcMGFZOhoxoI=jZvizrKbSnNmrIXSwxkhxxMlkTKrMGkslfbGCqMnQQWXZuCdQcuqWxNShkWAzGLjhcgOksfwINbEbPktdzjsmlcQBFastjtpyKJ console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'tzUWcQcizZROCbHthaAaDRlmONIoiXRnKRZPGmTbJGZoyCAhOcMGFZOhoxoI' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: SNymyyaoXpxnqRpZxxMeqnjFZYWvIgmNyHkChNkzSjSslTdjryOLXHDxBAmipWAJKHz=FGLHozlNFVxyHJzDmNPntRwNhtpWMpGDAXGvzuCEbPOFyxmmDXpWRVgOEYxrphqvgREKeWpakkqgrvHTFKzPZKMFJSSxMnxpPasgPObHNQLFUZLodBnmUkvEtZq console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'SNymyyaoXpxnqRpZxxMeqnjFZYWvIgmNyHkChNkzSjSslTdjryOLXHDxBAmipWAJKHz' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: Set ljmsHdQJbAEVVyEWXLadSmEozIJfWbFYIUQZzENumfOolOQAP=L console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: YlZOeAqrXbHjiphFXhseaKxLVCVOspjeZorYZsIoiHiOzIizHijCvlkgPhSAEkLNlEj=ufGFFoVLDGahcBulXKGOXPoMmoDVVzDOcihaAGXhfmKpUFyetBPAYnwsuUuvEZQprERhgOJsMznbtZRTrBQzDeQXyWjGmAIdJBudOROdRnOFZDjiehzrovFwOTisBeRjKoOCSAtkMAByglYBJtDkuEihVyCVKvOPGBUQPJgCposHUANDUFIbnGyyqAGNYpBdMMnMdo console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'YlZOeAqrXbHjiphFXhseaKxLVCVOspjeZorYZsIoiHiOzIizHijCvlkgPhSAEkLNlEj' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: ZPweYhmzcaZqtOsdqvOPgrAEqGqVieqjMTIHbDuSBikcYovCcvbfBabWfbeshDkzsMhkyJTb=WguRyFRlnALELLxcLaZBPFXWStjUlvLDqqErdylRkiOrAOGqTQzsTVAsslZqzWZwPoEKidtGoodHQUcrnkwxezJtAjLyypngoNhslVTCLNpLFSBbOVB console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'ZPweYhmzcaZqtOsdqvOPgrAEqGqVieqjMTIHbDuSBikcYovCcvbfBabWfbeshDkzsMhkyJTb' is not recognized as an internal or external command, operable program or batch file console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: UEYcnmlUEYBYJwmrGrTDsmJflYnHLgspHsxDORTKKZXMjlwEznQKeY=cVJlmqDodHsssGVgOloTaCWrqWUhhbGiJBZHtGzKuQGtUSKXbpwAUybTYFlDufVSwpIQHhpiQnMBVRoijWQrcyhDtuImvQDRVOrKlTfpZTJvaVXivedpmRvVWtLBEKLqUVGuOnWaGGtCvRkooBezAxsrsiNuiOEgoIBvfRaYyXDSNUmy console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'UEYcnmlUEYBYJwmrGrTDsmJflYnHLgspHsxDORTKKZXMjlwEznQKeY' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: CzrIsAADCPHKQlSePzNfOTdprgCQmdbIIhFxBFRowTNeLgfMKQXBLQtJeTFrXJtksZwDFnApCFhV=gnOYQuJaVWSoVsHqNlaPBKLjLujfNZuCpEOcQtiDxTvepcKuSpOxVuDEMBhJTxEWPfYdDjpJrPxIgIrdcuvElLHrqpJg console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'CzrIsAADCPHKQlSePzNfOTdprgCQmdbIIhFxBFRowTNeLgfMKQXBLQtJeTFrXJtksZwDFnApCFhV' is not recognized as an internal or external command, operable program or batch console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: bJqgmjUvxCGqtsuLUdrnWgNXqLtHVdxDUSFyxxOvoUwDQEyxBayTFQVpWegNojAtoryjMwsABHf=jpicGJuDlAXtWvosywhWzXxNnTIAqEsYATWNVSinuXTHywfdSZxAxzIfOxWMwFCFpZErmxvhTOQcrMHbDaHw console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'bJqgmjUvxCGqtsuLUdrnWgNXqLtHVdxDUSFyxxOvoUwDQEyxBayTFQVpWegNojAtoryjMwsABHf' is not recognized as an internal or external command, operable program or batch f console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: ile. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: REulGYBVxbAcgnuvjQnDiGFCjjwMmpJYAcscbSScVsmsdqOgBqsBpne=YDYxXOvlNCUTiKZzXeHPugjjbNlnSoOeaivTUnnuVgENuViQwYDuQhrKdLXlDYaFNRAZgynmEATSJnuBGzvUEIktrMCoBgDXVZqgxiCW console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'REulGYBVxbAcgnuvjQnDiGFCjjwMmpJYAcscbSScVsmsdqOgBqsBpne' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: Set rOGMQRmKtzrQjMwoYuLJiKtkqVfDVNpQN=p console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: DyKzcbYVIYlqzltkabgfzNgtawtmZKLyQRMTGEAmMDpogRupvUDjDvsPRFwxamWXjypBnkF=XPDQEyPBUUrtumBxAXwqDyujHkWpHELlgPfOSBlLPAAncRRNDPwAlFlRIdpapGTfoTPdpNBYMdleFIRPxoGSDlqJEbyCaSCpGldCwADPheOTxojqmzXqZwMXTyMMIZGTNqvcagOUFQFAvufvkyeZUBpFnaJVOQihvUyzLRIkErcp console_handle: 0x00000007	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: 'DyKzcbYVIYlqzltkabgfzNgtawtmZKLyQRMTGEAmMDpogRupvUDjDvsPRFwxamWXjypBnkF' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW April 8, 2021, 9:16 a.m.	buffer: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG> console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 8, 2021, 9:15 a.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 8, 2021, 9:31 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x74b24387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x74d4ef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x74d46a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x74d46b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x74d46a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x74d65c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x74de06b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x74bfd7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x74bfd876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x74bfddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x74b18a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x74b18938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x74b1950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x74bfdccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x74bfdb41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x74bfe1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x74b19367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x74b19326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x74ada48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x74ad853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x74ada4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x74aecd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x74aed87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 46264672 registers.edi: 4298396 registers.eax: 46264672 registers.ebp: 46264752 registers.edx: 4007236 registers.ebx: 46265036 registers.esi: 2147746133 registers.ecx: 4064032	1	0	0
__exception__ April 8, 2021, 9:31 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x74acfe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x74bfa338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x74f8e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x74f672ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x74f5ab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x74f8c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x74f587f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x74f58926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x74f5d55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x74f8c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x74f5d1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x74f5d1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x74f5d40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x74f5991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x74f58d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x74f5a0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x74f59b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x74f59aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x72126f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x72126e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x721227a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x72122652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x7212253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x72122411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x721225ab wmic+0x39c80 @ 0xc89c80 wmic+0x3b06a @ 0xc8b06a wmic+0x3b1f8 @ 0xc8b1f8 wmic+0x36fcd @ 0xc86fcd wmic+0x3d6e9 @ 0xc8d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2942800 registers.edi: 1957755408 registers.eax: 2942800 registers.ebp: 2942880 registers.edx: 1 registers.ebx: 4033660 registers.esi: 2147746133 registers.ecx: 1577056213	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 8, 2021, 9:31 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x74b24387
NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x74d4ef51
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x74d46a9c
NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x74d46b42
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x74d46a9c
NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x74d65c3a
NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x74de06b8
WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x74bfd7e6
WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x74bfd876
WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x74bfddd0
CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x74b18a43
CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x74b18938
DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x74b1950a
WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x74bfdccd
WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x74bfdb41
WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x74bfe1fd
DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x74b19367
DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x74b19326
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x74ada48b
CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x74ad853b
CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x74ada4ac
CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x74aecd48
CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x74aed87a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 46264672
registers.edi: 4298396
registers.eax: 46264672
registers.ebp: 46264752
registers.edx: 4007236
registers.ebx: 46265036
registers.esi: 2147746133
registers.ecx: 4064032

__exception__

April 8, 2021, 9:31 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x74acfe14
StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x74bfa338
IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x74f8e99f
IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x74f672ed
RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x74f5ab0d
IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x74f8c048
RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x74f587f7
RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x74f58926
RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x74f5d55e
IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x74f8c44b
RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x74f5d1f6
RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x74f5d1ac
RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x74f5d40b
RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x74f5991b
RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x74f58d67
RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x74f5a0d8
RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x74f59b85
RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x74f59aa8
DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x72126f4f
DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x72126e40
DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x721227a4
DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x72122652
DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x7212253d
DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x72122411
DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x721225ab
wmic+0x39c80 @ 0xc89c80
wmic+0x3b06a @ 0xc8b06a
wmic+0x3b1f8 @ 0xc8b1f8
wmic+0x36fcd @ 0xc86fcd
wmic+0x3d6e9 @ 0xc8d6e9
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2942800
registers.edi: 1957755408
registers.eax: 2942800
registers.ebp: 2942880
registers.edx: 1
registers.ebx: 4033660
registers.esi: 2147746133
registers.ecx: 1577056213

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST https://banusdoret.top/upload/upload.php

Performs some HTTP requests (2 events)

request	GET https://banusdoret.top/5e65aaa67ea5c920748e191e17645c6a932f8796
request	POST https://banusdoret.top/upload/upload.php

Sends data using the HTTP POST Method (1 event)

request

POST https://banusdoret.top/upload/upload.php

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

banusdoret.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 8, 2021, 9:15 a.m.	process_identifier: 7960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 9:16 a.m.	process_identifier: 4884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 9:16 a.m.	process_identifier: 9024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 9:16 a.m.	process_identifier: 6596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 8, 2021, 9:16 a.m.	process_identifier: 6596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 8, 2021, 9:31 a.m.	process_identifier: 5932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW April 8, 2021, 9:16 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13296603136 root_path: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG total_number_of_bytes: 0	1	1	0

Steals private information from local Internet browsers (5 events)

file	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1
file	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences
file	C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Preferences

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com
file	C:\Users\test22\AppData\Roaming\WhAnoTHmid\wAYZqHgYEOdcYU.js
file	C:\Users\test22\AppData\Roaming\WhAnoTHmid\RbzUOZJPQt.exe.com

Creates a suspicious process (6 events)

cmdline	cmd /c C:\Windows\System32\cmd.exe < Poi.vsd
cmdline	cmd.exe /C wmic process get Name > "C:\Users\test22\AppData\Local\Temp\chrD799.tmp"
cmdline	cmd.exe /C ver > "C:\Users\test22\AppData\Local\Temp\chrD6EC.tmp"
cmdline	C:\Windows\System32\cmd.exe
cmdline	"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Poi.vsd
cmdline	wmic process get Name

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\WhAnoTHmid\RbzUOZJPQt.exe.com

Executes one or more WMI queries (1 event)

wmi	SELECT Name FROM Win32_Process

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 8, 2021, 9:16 a.m.	show_type: 0 filepath_r: dllhost.exe parameters: filepath: dllhost.exe	1	1	0
ShellExecuteExW April 8, 2021, 9:16 a.m.	show_type: 0 filepath_r: cmd parameters: /c C:\Windows\System32\cmd.exe < Poi.vsd filepath: cmd	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (45 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over Toredo network	rule	network_toredo
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd.exe /C wmic process get Name > "C:\Users\test22\AppData\Local\Temp\chrD799.tmp"
cmdline	ping 127.0.0.1 -n 30
cmdline	wmic process get Name

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 97289905920c8c752cd382df2fdebd9a651f0d61

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 8, 2021, 9:16 a.m.	process_identifier: 5352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 18182144 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 process_handle: 0x00000210	1	0	0

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RbzUOZJPQt.url

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 8, 2021, 9:16 a.m.	buffer: ÿÿÿÿsûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 5352 process_handle: 0x00000210	1	1	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Bkav	W32.AIDetect.malware1
McAfee	Artemis!68E2FF114060
Malwarebytes	Malware.AI.2430735816
Sangfor	Riskware.Win32.Wacapew.C
Avast	FileRepMalware
Kaspersky	Trojan.Win32.Bingoml.bqso
Rising	Trojan.HiddenRun/SFX!1.D2BC (CLASSIC)
Emsisoft	Trojan-Dropper.Agent (A)
McAfee-GW-Edition	BehavesLike.Win32.Sality.tc
Microsoft	Trojan:Win32/Wacatac.B!ml
Cylance	Unsafe
eGambit	Unsafe.AI_Score_92%
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_60% (W)

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 6596 called NtSetContextThread to modify thread in remote process 5352
NtSetContextThread April 8, 2021, 9:16 a.m.	registers.eip: 2000355780 registers.esp: 7534652 registers.edi: 0 registers.eax: 7649168 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000208 process_identifier: 5352	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8704 resumed a thread in remote process 4884
NtResumeThread April 8, 2021, 9:16 a.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 4884	1	0	0

Executed a process and injected code into it, probably while unpacking (25 events)

Time & API	Arguments	Status	Return
NtResumeThread April 8, 2021, 9:15 a.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 7960	1	0
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 3700 thread_handle: 0x00000288 process_identifier: 5916 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\dllhost.exe track: 1 command_line: "C:\Windows\System32\dllhost.exe" filepath_r: C:\Windows\System32\dllhost.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000290	1	1
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 8340 thread_handle: 0x000002bc process_identifier: 4384 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Poi.vsd filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002d0	1	1
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 4408 thread_handle: 0x00000088 process_identifier: 8704 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\cmd.exe track: 1 command_line: C:\Windows\System32\cmd.exe filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 2724 thread_handle: 0x0000008c process_identifier: 8168 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 2268 thread_handle: 0x00000090 process_identifier: 4884 current_directory: filepath: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com track: 1 command_line: Agli.exe.com D filepath_r: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread April 8, 2021, 9:16 a.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 4884	1	0
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 4404 thread_handle: 0x00000094 process_identifier: 5272 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 127.0.0.1 -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 1812 thread_handle: 0x0000012c process_identifier: 9024 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com D filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000130	1	1
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 7316 thread_handle: 0x00000128 process_identifier: 6596 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com D filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000012c	1	1
NtResumeThread April 8, 2021, 9:16 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 5272	1	0
CreateProcessInternalW April 8, 2021, 9:16 a.m.	thread_identifier: 7908 thread_handle: 0x00000208 process_identifier: 5352 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000210	1	1
NtGetContextThread April 8, 2021, 9:16 a.m.	thread_handle: 0x00000208	1	0
NtAllocateVirtualMemory April 8, 2021, 9:16 a.m.	process_identifier: 5352 region_size: 18182144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00730000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000210	1	0
WriteProcessMemory April 8, 2021, 9:16 a.m.	buffer: base_address: 0x00730000 process_identifier: 5352 process_handle: 0x00000210	1	1
WriteProcessMemory April 8, 2021, 9:16 a.m.	buffer: ÿÿÿÿsûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 5352 process_handle: 0x00000210	1	1
NtSetContextThread April 8, 2021, 9:16 a.m.	registers.eip: 2000355780 registers.esp: 7534652 registers.edi: 0 registers.eax: 7649168 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000208 process_identifier: 5352	1	0
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 5704 thread_handle: 0x00000494 process_identifier: 7632 current_directory: filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\system32\rundll32.exe" "C:\Windows\syswow64\WinInet.dll",DispatchAPICall 1 filepath_r: C:\Windows\system32\rundll32.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000498	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 1904 thread_handle: 0x000004b0 process_identifier: 8888 current_directory: filepath: track: 1 command_line: cmd.exe /C ver > "C:\Users\test22\AppData\Local\Temp\chrD6EC.tmp" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000004ac	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 6140 thread_handle: 0x000004b8 process_identifier: 7096 current_directory: filepath: track: 1 command_line: cmd.exe /C wmic process get Name > "C:\Users\test22\AppData\Local\Temp\chrD799.tmp" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000004b4	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 3464 thread_handle: 0x000004c0 process_identifier: 4468 current_directory: filepath: track: 1 command_line: cmd /c makecab /V3 "C:\Users\test22\AppData\Local\Temp\5e65aaa67ea5c920748e191e17645c6a932f8796" "C:\Users\test22\AppData\Local\Temp\chrD96F.tmp" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000004bc	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 1912 thread_handle: 0x000004d4 process_identifier: 7160 current_directory: filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\system32\rundll32.exe" "C:\Windows\syswow64\WinInet.dll",DispatchAPICall 1 filepath_r: C:\Windows\system32\rundll32.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000004d8	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 7460 thread_handle: 0x000004d8 process_identifier: 6164 current_directory: filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\system32\rundll32.exe" "C:\Windows\syswow64\WinInet.dll",DispatchAPICall 1 filepath_r: C:\Windows\system32\rundll32.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000004c4	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 5988 thread_handle: 0x00000084 process_identifier: 5932 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\wbem\WMIC.exe track: 1 command_line: wmic process get Name filepath_r: C:\Windows\System32\Wbem\WMIC.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW April 8, 2021, 9:31 a.m.	thread_identifier: 2540 thread_handle: 0x00000084 process_identifier: 1388 current_directory: C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG filepath: C:\Windows\System32\makecab.exe track: 1 command_line: makecab /V3 "C:\Users\test22\AppData\Local\Temp\5e65aaa67ea5c920748e191e17645c6a932f8796" "C:\Users\test22\AppData\Local\Temp\chrD96F.tmp" filepath_r: C:\Windows\system32\makecab.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

ya.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All