Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 20, 2021, 9:29 a.m.	April 20, 2021, 9:42 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bebcbeef93c5ee64473336c98c6a13c4`
SHA256	`fdb0d0d3bf868ed29271788015e69f9e193347c1bcd37e518d09e51e6a2da117`
CRC32	`B966B667`
ssdeep	`24576:FiLDfJXRq+fowpGG7By3Z72mwE8gKmX9hIbEIKn:FiLr5By3Z7NMgKAj`
Yara	screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasOverlay - Overlay Check borland_delphi - Borland Delphi 2.0 - 7.0 / 2005 - 2007

Iyjomdb_Signed_.xls "C:\Users\test22\AppData\Local\Temp\Iyjomdb_Signed_.xls"
5776
- Iyjomdb_Signed_.xls "C:\Users\test22\AppData\Local\Temp\Iyjomdb_Signed_.xls"
  7444

Name	Response	Post-Analysis Lookup
discord.com	A 162.159.137.232 A 162.159.138.232 A 162.159.128.233 A 162.159.135.232 A 162.159.136.232	162.159.137.232
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.133.233

IP Address	Status	Action
104.21.19.200	Active	Moloch
162.159.135.233	Active	Moloch
162.159.136.232	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49811 -> 162.159.135.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49811 162.159.135.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 20, 2021, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 20, 2021, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 20, 2021, 9:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 20, 2021, 9:40 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 20, 2021, 9:40 a.m.			0	0
IsDebuggerPresent April 20, 2021, 9:40 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey April 20, 2021, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054f928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 20, 2021, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054f928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 20, 2021, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005abaa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 20, 2021, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005abaa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 20, 2021, 9:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005abae0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 20, 2021, 9:40 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 20, 2021, 9:40 a.m.	stacktrace: 0x217cb40 0x217c34b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737 mscorlib+0x2d3711 @ 0x6eeb3711 mscorlib+0x308f2d @ 0x6eee8f2d 0x21703f5 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737 mscorlib+0x2d3711 @ 0x6eeb3711 mscorlib+0x308f2d @ 0x6eee8f2d mscorlib+0x3133fd @ 0x6eef33fd mscorlib+0x9873b1 @ 0x6f5673b1 mscorlib+0x97b352 @ 0x6f55b352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x6fba2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x6fc9cd14 0x1e0a062 iyjomdb_signed_+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 e3 23 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x217cfb3 registers.esp: 1634064 registers.edi: 1634088 registers.eax: 0 registers.ebp: 1634100 registers.edx: 195 registers.ebx: 1634804 registers.esi: 38704576 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 20, 2021, 9:40 a.m.

stacktrace:

0x217cb40
0x217c34b
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737
mscorlib+0x2d3711 @ 0x6eeb3711
mscorlib+0x308f2d @ 0x6eee8f2d
0x21703f5
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737
mscorlib+0x2d3711 @ 0x6eeb3711
mscorlib+0x308f2d @ 0x6eee8f2d
mscorlib+0x3133fd @ 0x6eef33fd
mscorlib+0x9873b1 @ 0x6f5673b1
mscorlib+0x97b352 @ 0x6f55b352
DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x6fba2a8e
DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x6fc9cd14
0x1e0a062
iyjomdb_signed_+0x2403 @ 0x402403

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 e3 23
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x217cfb3
registers.esp: 1634064
registers.edi: 1634088
registers.eax: 0
registers.ebp: 1634100
registers.edx: 195
registers.ebx: 1634804
registers.esi: 38704576
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET https://cdn.discordapp.com/attachments/775608373949235243/781771882017456178/Iyjobgr

Allocates read-write-execute memory (usually to unpack itself) (49 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 5776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 5776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 5776 region_size: 380928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fc0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02110000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02111000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02113000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02114000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02171000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0217a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e27000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0217b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738d4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0217c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0217d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0217e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0217f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:40 a.m.	process_identifier: 7444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 380928 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x020d1000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000b1400', u'virtual_address': u'0x00091000', u'entropy': 7.140311708115569, u'name': u'.rsrc', u'virtual_size': u'0x000b1400'}

entropy

7.14031170812

description

A section with a high entropy has been found

entropy

0.563593004769

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 20, 2021, 9:40 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 4f67e5329c910478b10867afc41f4f3a266c6f62

Communicates with host for which no DNS query was performed (2 events)

host	104.21.19.200
host	172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 7444 region_size: 380928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004ec	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 20, 2021, 9:40 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

Iyjomdb_Signed_.xls tried to sleep 10912854 seconds, actually delayed analysis time by 10912854 seconds

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA April 20, 2021, 9:29 a.m.	key_handle: 0x00000244 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 20, 2021, 9:29 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 7444 process_handle: 0x000004ec	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5776 called NtSetContextThread to modify thread in remote process 7444
NtSetContextThread April 20, 2021, 9:29 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4246831 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002cc process_identifier: 7444	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 5776 resumed a thread in remote process 7444
NtResumeThread April 20, 2021, 9:29 a.m.	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 7444	1	0	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 20, 2021, 9:29 a.m.	thread_identifier: 8572 thread_handle: 0x000002cc process_identifier: 7444 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Iyjomdb_Signed_.xls track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Iyjomdb_Signed_.xls stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000004ec	1	1
NtGetContextThread April 20, 2021, 9:29 a.m.	thread_handle: 0x000002cc	1	0
NtUnmapViewOfSection April 20, 2021, 9:29 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 7444 process_handle: 0x000004ec	1	0
NtAllocateVirtualMemory April 20, 2021, 9:29 a.m.	process_identifier: 7444 region_size: 380928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004ec	1	0
WriteProcessMemory April 20, 2021, 9:29 a.m.	buffer: base_address: 0x00400000 process_identifier: 7444 process_handle: 0x000004ec	1	1
WriteProcessMemory April 20, 2021, 9:29 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 7444 process_handle: 0x000004ec	1	1
NtSetContextThread April 20, 2021, 9:29 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4246831 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002cc process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:29 a.m.	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x000001cc suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x00000328 suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:40 a.m.	thread_handle: 0x00000424 suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:41 a.m.	thread_handle: 0x0000036c suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:41 a.m.	thread_handle: 0x00000418 suspend_count: 1 process_identifier: 7444	1	0
NtResumeThread April 20, 2021, 9:41 a.m.	thread_handle: 0x00000418 suspend_count: 1 process_identifier: 7444	1	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.349874
FireEye	Generic.mg.bebcbeef93c5ee64
McAfee	Fareit-FZO!BEBCBEEF93C5
Cylance	Unsafe
Zillya	Trojan.Blocker.Win32.63647
Sangfor	Trojan.Win32.Blocker.usrg
K7AntiVirus	Trojan ( 00573eb71 )
Alibaba	Ransom:Win32/Blocker.807abc98
K7GW	Trojan ( 00573eb71 )
Cybereason	malicious.f93c5e
Cyren	W32/Injector.TADC-2976
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ENZR
APEX	Malicious
Avast	Win32:InjectorX-gen [Trj]
Kaspersky	HEUR:Trojan-Ransom.Win32.Blocker.gen
BitDefender	Gen:Variant.Zusy.349874
NANO-Antivirus	Trojan.Win32.Blocker.icwfqo
Paloalto	generic.ml
Tencent	Malware.Win32.Gencirc.10ce23ad
Ad-Aware	Gen:Variant.Zusy.349874
Sophos	Mal/Generic-R + Troj/AutoG-KJ
Comodo	Malware@#10fg805is5r4z
DrWeb	Trojan.DownLoader36.19072
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Fareit-FZO!BEBCBEEF93C5
Emsisoft	Gen:Variant.Zusy.349874 (B)
SentinelOne	Static AI - Suspicious PE
GData	Gen:Variant.Zusy.349874
Jiangmin	Trojan.Blocker.stf
Avira	TR/Injector.hdgha
Gridinsoft	Trojan.Win32.Downloader.oa!s1
AegisLab	Trojan.Win32.Blocker.j!c
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R356817
BitDefenderTheta	Gen:NN.ZelphiF.34678.qHY@aSG3mppi
ALYac	Gen:Variant.Zusy.349874
MAX	malware (ai score=88)
VBA32	Malware-Cryptor.Limpopo
Malwarebytes	Spyware.PasswordStealer
Zoner	Trojan.Win32.99006
Rising	Trojan.Injector!8.C4 (TFE:2:N0ZPNYNXppN)
Yandex	Trojan.Igent.bUSTeN.1
Ikarus	Trojan.Inject
eGambit	PE.Heur.InvalidSig
Fortinet	W32/GenKryptik.EKLE!tr
AVG	Win32:InjectorX-gen [Trj]

Iyjomdb_Signed_.xls

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All