Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 22, 2021, 10:48 a.m.	April 22, 2021, 10:53 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5c2e20cf98a0d8918ddec80ef4ccf067`
SHA256	`65778b8834d7849f816c747ae7f3dfc5466ded7781b34959d53cb1a544aaeef5`
CRC32	`E00DA50C`
ssdeep	`24576:FUt3aMJURRRRRiii9Jw6HmPg96s6wE67vJWZ:uRHJURRRRR+A6HmPgws6wE8vJWZ`
Yara	PE_Header_Zero - PE File Signature Zero Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description)

svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
7144

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 22, 2021, 10:48 a.m.			0	0
IsDebuggerPresent April 22, 2021, 10:48 a.m.			0	0
IsDebuggerPresent April 22, 2021, 10:50 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 22, 2021, 10:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f2e08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2021, 10:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f2e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2021, 10:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006f2e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 22, 2021, 10:48 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 84 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:48 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05250178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x052501a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x052501c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x052c419e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x052c4192 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05250208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0529e8d8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0529e8fc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0529e904 process_handle: 0xffffffff		3221225550

Creates a suspicious process (1 event)

cmdline

C:\Users\test22\AppData\Local\Temp\svchost.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00101e00', u'virtual_address': u'0x00002000', u'entropy': 7.1039949553390915, u'name': u'.text', u'virtual_size': u'0x00101c64'}

entropy

7.10399495534

description

A section with a high entropy has been found

entropy

0.906016688625

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 22, 2021, 10:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Created a process named as a common system process (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7672 thread_handle: 0x000002e4 process_identifier: 8140 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002e8	1	1
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 8004 thread_handle: 0x000002f0 process_identifier: 3100 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002ec	1	1
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7908 thread_handle: 0x000002f8 process_identifier: 5352 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002f4	1	1
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7932 thread_handle: 0x00000300 process_identifier: 7312 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002fc	1	1
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 3932 thread_handle: 0x00000308 process_identifier: 4744 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000304	1	1

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 8140 process_handle: 0x000002f0
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 8140 process_handle: 0x000002f0	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 3100 process_handle: 0x000002f8
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 3100 process_handle: 0x000002f8	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 5352 process_handle: 0x00000300
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 5352 process_handle: 0x00000300	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 7312 process_handle: 0x00000308
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 7312 process_handle: 0x00000308	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 4744 process_handle: 0x00000310
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 4744 process_handle: 0x00000310	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 8140 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 3100 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5352 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002f4	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7312 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002fc	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 4744 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000304	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 7144 manipulating memory of non-child process 8140
Process injection	Process 7144 manipulating memory of non-child process 3100
Process injection	Process 7144 manipulating memory of non-child process 5352
Process injection	Process 7144 manipulating memory of non-child process 7312
Process injection	Process 7144 manipulating memory of non-child process 4744
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 8140 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 3100 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5352 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002f4	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7312 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002fc	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 4744 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000304	3221225496	0

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.5c2e20cf98a0d891
BitDefenderTheta	Gen:NN.ZemsilF.34678.hn0@aqlHD3e
Cyren	W32/MSIL_Kryptik.DZG.gen!Eldorado
Symantec	Scr.Malcode!gdn30
APEX	Malicious
Sophos	ML/PE-A
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R348409
Malwarebytes	Malware.AI.4275721012
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.ZXG!tr

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread April 22, 2021, 10:48 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 7144	1	0
NtResumeThread April 22, 2021, 10:48 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 7144	1	0
NtResumeThread April 22, 2021, 10:48 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 7144	1	0
NtResumeThread April 22, 2021, 10:48 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 7144	1	0
NtResumeThread April 22, 2021, 10:50 a.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 7144	1	0
NtResumeThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 7144	1	0
NtResumeThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 7144	1	0
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7672 thread_handle: 0x000002e4 process_identifier: 8140 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002e8	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002e4	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 8140 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 8004 thread_handle: 0x000002f0 process_identifier: 3100 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002ec	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002f0	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 3100 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7908 thread_handle: 0x000002f8 process_identifier: 5352 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002f4	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002f8	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5352 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002f4		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7932 thread_handle: 0x00000300 process_identifier: 7312 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002fc	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x00000300	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 7312 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002fc		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 3932 thread_handle: 0x00000308 process_identifier: 4744 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000304	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x00000308	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 4744 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000304		3221225496

svchost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All