Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 8, 2021, 5:45 p.m.	April 8, 2021, 5:59 p.m.

Size	634.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`01158bfc4ce6cb2c5a3cdbf661f13f8b`
SHA256	`4ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09`
CRC32	`AE66D73A`
ssdeep	`12288:9z54oxOwaGspLEPkLhHICpVazP9czBBo2OjKTe2/WQI6xfm:9z5GwupWkLdpGP9AYKThWQXxf`
Yara	Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check

origg.exe "C:\Users\test22\AppData\Local\Temp\origg.exe"
5980
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp"
  7884

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 8, 2021, 5:57 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (39 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 8, 2021, 5:45 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:45 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0
IsDebuggerPresent April 8, 2021, 5:47 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 8, 2021, 5:57 p.m.	buffer: SUCCESS: The scheduled task "Updates\VKAeWEikAShZpp" has successfully been created. console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 8, 2021, 5:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d3190 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 8, 2021, 5:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d2b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 8, 2021, 5:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d2b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 8, 2021, 5:45 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 85 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00602000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00635000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00637000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00626000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00811000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00818000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00819000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:45 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0081f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ed1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055c0178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055c01a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055c01c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0563344e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05633442 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055c0208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0560dc40 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0560dc64 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 5980 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0560dc6c process_handle: 0xffffffff		3221225550

A process attempted to delay the analysis task. (1 event)

description

origg.exe tried to sleep 195 seconds, actually delayed analysis time by 195 seconds

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp"
cmdline	schtasks.exe /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 8, 2021, 5:47 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0009e000', u'virtual_address': u'0x00002000', u'entropy': 7.599375048310672, u'name': u'.text', u'virtual_size': u'0x0009df9c'}

entropy

7.59937504831

description

A section with a high entropy has been found

entropy

0.996845425868

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 8, 2021, 5:47 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (3 events)

description	Communications smtp	rule	network_smtp_dotNet
description	Run a keylogger	rule	keylogger
description	Affect hook table	rule	win_hook

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp"
cmdline	schtasks.exe /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 8496 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	1	0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5980 manipulating memory of non-child process 8496
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 8496 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	1	0	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5980 injected into non-child 8496
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELUvI`àVÞu @ À@uO H.textäU V `.rsrcX@@.reloc ^@B base_address: 0x00400000 process_identifier: 8496 process_handle: 0x000002c0	1	1	0
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: 8Ph \| ê\|4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ÜStringFileInfo¸000004b0,FileDescription 0FileVersion0.0.0.0TInternalNameZLGbMGFFseWUKMCXRuKzK.exe(LegalCopyright \OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00438000 process_identifier: 8496 process_handle: 0x000002c0	1	1	0
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: pà5 base_address: 0x0043a000 process_identifier: 8496 process_handle: 0x000002c0	1	1	0
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 8496 process_handle: 0x000002c0	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5980 injected into non-child 8496
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELUvI`àVÞu @ À@uO H.textäU V `.rsrcX@@.reloc ^@B base_address: 0x00400000 process_identifier: 8496 process_handle: 0x000002c0	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5980 called NtSetContextThread to modify thread in remote process 8496
NtSetContextThread April 8, 2021, 5:47 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421086 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003ec process_identifier: 8496	1	0	0

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.01158bfc4ce6cb2c
McAfee	Artemis!01158BFC4CE6
Alibaba	Trojan:Win32/starter.ali1000139
BitDefenderTheta	Gen:NN.ZemsilCO.34670.Nm0@aOLuijp
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Sophos	ML/PE-A
MaxSecure	Trojan.Malware.300983.susgen
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	MSIL.Trojan-Stealer.AgentTesla.BH9TA3
Cynet	Malicious (score: 100)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.AAIB!tr
AVG	FileRepMetagen [Malware]
Avast	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	Win32/Heur.Generic.HwMAcMkA

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 5980	1	0
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 5980	1	0
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 5980	1	0
NtResumeThread April 8, 2021, 5:45 p.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 5980	1	0
NtResumeThread April 8, 2021, 5:47 p.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 5980	1	0
NtResumeThread April 8, 2021, 5:47 p.m.	thread_handle: 0x000002dc suspend_count: 1 process_identifier: 5980	1	0
NtResumeThread April 8, 2021, 5:47 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 5980	1	0
CreateProcessInternalW April 8, 2021, 5:47 p.m.	thread_identifier: 6552 thread_handle: 0x00000428 process_identifier: 7884 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKAeWEikAShZpp" /XML "C:\Users\test22\AppData\Local\Temp\tmp9D34.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000430	1	1
CreateProcessInternalW April 8, 2021, 5:47 p.m.	thread_identifier: 3064 thread_handle: 0x000003ec process_identifier: 8496 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\origg.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\origg.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002c0	1	1
NtGetContextThread April 8, 2021, 5:47 p.m.	thread_handle: 0x000003ec	1	0
NtAllocateVirtualMemory April 8, 2021, 5:47 p.m.	process_identifier: 8496 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	1	0
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELUvI`àVÞu @ À@uO H.textäU V `.rsrcX@@.reloc ^@B base_address: 0x00400000 process_identifier: 8496 process_handle: 0x000002c0	1	1
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: base_address: 0x00402000 process_identifier: 8496 process_handle: 0x000002c0	1	1
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: 8Ph \| ê\|4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ÜStringFileInfo¸000004b0,FileDescription 0FileVersion0.0.0.0TInternalNameZLGbMGFFseWUKMCXRuKzK.exe(LegalCopyright \OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00438000 process_identifier: 8496 process_handle: 0x000002c0	1	1
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: pà5 base_address: 0x0043a000 process_identifier: 8496 process_handle: 0x000002c0	1	1
WriteProcessMemory April 8, 2021, 5:47 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 8496 process_handle: 0x000002c0	1	1
NtSetContextThread April 8, 2021, 5:47 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421086 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003ec process_identifier: 8496	1	0

origg.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All