Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 10, 2021, 9:04 a.m.	April 10, 2021, 9:10 a.m.

Size	1.8MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a74ece32bc1b6db38a2d379c7fc78d2c`
SHA256	`20e490afba639ea251a2f095a8b9b85e1b9922ff6d8b6f47ceb567ba62521a28`
CRC32	`DE44B4E9`
ssdeep	`49152:9Ni8vaKvPuXtaD5LNaw/RRMbBRtlxaJvxdrLBF+F36q:Bzv4w/RRMbBRZaJvz3XO35`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check

loki.exe "C:\Users\test22\AppData\Local\Temp\loki.exe"
4564
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp"
  4012
- RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  8140

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
79.134.225.30	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 10, 2021, 9:03 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 10, 2021, 9:01 a.m.			0	0
IsDebuggerPresent April 10, 2021, 9:01 a.m.			0	0
IsDebuggerPresent April 10, 2021, 9:03 a.m.			0	0
IsDebuggerPresent April 10, 2021, 9:03 a.m.			0	0
IsDebuggerPresent April 10, 2021, 9:03 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 10, 2021, 9:03 a.m.	buffer: SUCCESS: The scheduled task "Updates\tHyARuOEdFlN" has successfully been created. console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 10, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f3b48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f2f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003f2f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 10, 2021, 9:01 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 10, 2021, 9:03 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6f6b1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6f582ba1 mscorlib+0x2f136b @ 0x64ea136b mscorlib+0x355fec @ 0x64f05fec mscorlib+0x32d99a @ 0x64edd99a mscorlib+0x32d54b @ 0x64edd54b 0x75b2ed 0x75890e 0x7587ff DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6f581838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6f581737 mscorlib+0x305edf @ 0x64eb5edf mscorlib+0x2e9e1b @ 0x64e99e1b mscorlib+0x2e99c1 @ 0x64e999c1 mscorlib+0x2de184 @ 0x64e8e184 0x75830a 0x757c1d 0x7507f3 0x750614 system+0xaac56b @ 0x64a3c56b system+0x1fe5cb @ 0x6418e5cb system+0x1fe55e @ 0x6418e55e system+0x1fe4a3 @ 0x6418e4a3 mscorlib+0x302367 @ 0x64eb2367 mscorlib+0x3022a6 @ 0x64eb22a6 mscorlib+0x302261 @ 0x64eb2261 system+0x1fe431 @ 0x6418e431 system+0x1fe237 @ 0x6418e237 system+0x1ee37d @ 0x6417e37d system+0x1f70ea @ 0x641870ea system+0x1e56c0 @ 0x641756c0 system+0x1f6e10 @ 0x64186e10 system+0x1ee251 @ 0x6417e251 system+0x1ee229 @ 0x6417e229 system+0x1ee170 @ 0x6417e170 0x5ba08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a system+0x2093cc @ 0x641993cc system+0x1fdca1 @ 0x6418dca1 system+0x1fd921 @ 0x6418d921 system+0x1fd792 @ 0x6418d792 system+0x1a14bd @ 0x641314bd 0x7501ba DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3597020 registers.edi: 0 registers.eax: 3597020 registers.ebp: 3597100 registers.edx: 0 registers.ebx: 5641936 registers.esi: 4993888 registers.ecx: 3042162261	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 10, 2021, 9:03 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6f6b1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6f582ba1
mscorlib+0x2f136b @ 0x64ea136b
mscorlib+0x355fec @ 0x64f05fec
mscorlib+0x32d99a @ 0x64edd99a
mscorlib+0x32d54b @ 0x64edd54b
0x75b2ed
0x75890e
0x7587ff
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6f581838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6f581737
mscorlib+0x305edf @ 0x64eb5edf
mscorlib+0x2e9e1b @ 0x64e99e1b
mscorlib+0x2e99c1 @ 0x64e999c1
mscorlib+0x2de184 @ 0x64e8e184
0x75830a
0x757c1d
0x7507f3
0x750614
system+0xaac56b @ 0x64a3c56b
system+0x1fe5cb @ 0x6418e5cb
system+0x1fe55e @ 0x6418e55e
system+0x1fe4a3 @ 0x6418e4a3
mscorlib+0x302367 @ 0x64eb2367
mscorlib+0x3022a6 @ 0x64eb22a6
mscorlib+0x302261 @ 0x64eb2261
system+0x1fe431 @ 0x6418e431
system+0x1fe237 @ 0x6418e237
system+0x1ee37d @ 0x6417e37d
system+0x1f70ea @ 0x641870ea
system+0x1e56c0 @ 0x641756c0
system+0x1f6e10 @ 0x64186e10
system+0x1ee251 @ 0x6417e251
system+0x1ee229 @ 0x6417e229
system+0x1ee170 @ 0x6417e170
0x5ba08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
system+0x2093cc @ 0x641993cc
system+0x1fdca1 @ 0x6418dca1
system+0x1fd921 @ 0x6418d921
system+0x1fd792 @ 0x6418d792
system+0x1a14bd @ 0x641314bd
0x7501ba
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3597020
registers.edi: 0
registers.eax: 3597020
registers.ebp: 3597100
registers.edx: 0
registers.ebx: 5641936
registers.esi: 4993888
registers.ecx: 3042162261

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 128 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02270000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00545000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00537000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00781000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00536000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00784000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00785000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:01 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00786000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00787000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00788000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00789000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05450178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054501a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054501c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054ccfbe process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054ccfb2 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05450208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054a7800 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054a7824 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054a782c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 4564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054a7830 process_handle: 0xffffffff		3221225550

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp"
cmdline	schtasks.exe /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 10, 2021, 9:03 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0015d200', u'virtual_address': u'0x00002000', u'entropy': 7.507741661502335, u'name': u'.text', u'virtual_size': u'0x0015d0e4'}

entropy

7.5077416615

description

A section with a high entropy has been found

entropy

0.766675816635

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 10, 2021, 9:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW April 10, 2021, 9:03 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (13 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Communications use DNS	rule	network_dns
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp"
cmdline	schtasks.exe /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp"

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	79.134.225.30

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 8140 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 10, 2021, 9:03 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

RegSvcs.exe tried to sleep 578370627 seconds, actually delayed analysis time by 578370627 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host

reg_value

C:\Program Files (x86)\SMTP Host\smtphost.exe

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 8140 process_handle: 0x000002b4	1	1
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: à7 base_address: 0x00420000 process_identifier: 8140 process_handle: 0x000002b4	1	1
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 8140 process_handle: 0x000002b4	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 8140 process_handle: 0x000002b4	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 4564 called NtSetContextThread to modify thread in remote process 8140
NtSetContextThread April 10, 2021, 9:03 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003f0 process_identifier: 8140	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 4564 resumed a thread in remote process 8140
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 8140	1	0	0

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Elastic	malicious (high confidence)
McAfee	Artemis!A74ECE32BC1B
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZemsilF.34670.Xn0@aGv6omo
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.AAJF
APEX	Malicious
Avast	FileRepMetagen [Malware]
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Ikarus	Win32.Outbreak
Webroot	W32.Malware.Gen
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Yandex	Trojan.AvsArher.bTJEKx
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/Kryptik.AAIB!tr
AVG	FileRepMetagen [Malware]
Cybereason	malicious.67b842
Qihoo-360	Win32/TrojanSpy.Noon.HgIASSYA

Executed a process and injected code into it, probably while unpacking (34 events)

Time & API	Arguments	Status	Return
NtResumeThread April 10, 2021, 9:01 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:01 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:01 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:01 a.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000002d0 suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 4564	1	0
CreateProcessInternalW April 10, 2021, 9:03 a.m.	thread_identifier: 6380 thread_handle: 0x0000042c process_identifier: 4012 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tHyARuOEdFlN" /XML "C:\Users\test22\AppData\Local\Temp\tmp94EC.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000434	1	1
CreateProcessInternalW April 10, 2021, 9:03 a.m.	thread_identifier: 7672 thread_handle: 0x000003f0 process_identifier: 8140 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002b4	1	1
NtGetContextThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003f0	1	0
NtAllocateVirtualMemory April 10, 2021, 9:03 a.m.	process_identifier: 8140 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4	1	0
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x00400000 process_identifier: 8140 process_handle: 0x000002b4	1	1
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: base_address: 0x00402000 process_identifier: 8140 process_handle: 0x000002b4	1	1
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: à7 base_address: 0x00420000 process_identifier: 8140 process_handle: 0x000002b4	1	1
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: base_address: 0x00422000 process_identifier: 8140 process_handle: 0x000002b4	1	1
WriteProcessMemory April 10, 2021, 9:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 8140 process_handle: 0x000002b4	1	1
NtSetContextThread April 10, 2021, 9:03 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003f0 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x00000434 suspend_count: 1 process_identifier: 4564	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 8140	1	0
NtGetContextThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread April 10, 2021, 9:03 a.m.	registers.eip: 1868049284 registers.esp: 3597228 registers.edi: 0 registers.eax: 63336436 registers.ebp: 3597272 registers.edx: 115 registers.ebx: 38063979 registers.esi: 116 registers.ecx: 225669743 thread_handle: 0x000000e0 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003a8 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 8140	1	0
NtResumeThread April 10, 2021, 9:03 a.m.	thread_handle: 0x000003dc suspend_count: 1 process_identifier: 8140	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	192.168.56.102:49812
dead_host	192.168.56.102:49813
dead_host	79.134.225.30:1144

loki.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All