ARMV7L

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 19, 2021, 8:48 a.m.			0	0
IsDebuggerPresent April 19, 2021, 8:49 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 19, 2021, 8:48 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72821000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e621000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:48 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:49 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 19, 2021, 8:49 a.m.	process_identifier: 6952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (9 events)

description	Affect private profile				rule	win_files_operation
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

Attempts to modify browser security settings (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

DrWeb	Linux.BackDoor.Fgt.1755
ESET-NOD32	a variant of Linux/Mirai.AYC
TrendMicro-HouseCall	Backdoor.Linux.MIRAI.SMMRX1
ClamAV	Unix.Trojan.DarkNexus-7679166-0
Kaspersky	HEUR:Backdoor.Linux.Mirai.b
Tencent	Backdoor.Linux.Mirai.wuh
TrendMicro	Backdoor.Linux.MIRAI.SMMRX1
Jiangmin	Backdoor.Linux.fpis
Ikarus	Trojan.Linux.Gafgyt
Fortinet	Linux/Gafgyt.AXI!tr

Harvests credentials from local email clients (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Mozilla Thunderbird\Capabilities\Hidden

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 5032 resumed a thread in remote process 5192
Time & API	Arguments	Status	Return	Repeated
NtResumeThread April 19, 2021, 8:48 a.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 5192	1	0	0