43f4dab6d5ea1eecee44d7e673ab980a.exe

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 24, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 24, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 24, 2021, 5:54 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 24, 2021, 5:54 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 24, 2021, 5:54 p.m.	process_identifier: 3804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 24, 2021, 5:54 p.m.	process_identifier: 3804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 24, 2021, 5:54 p.m.	process_identifier: 3804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 24, 2021, 5:54 p.m.	process_identifier: 3804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 24, 2021, 5:54 p.m.	process_identifier: 7144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 24, 2021, 5:54 p.m.	process_identifier: 7144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW April 24, 2021, 5:54 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 8550928545126285312 root_path: C:\Program Files (x86)\SME\Cloud Tools\ total_number_of_bytes: 0		0	0
GetDiskFreeSpaceExW April 24, 2021, 5:54 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 8550928545126285312 root_path: C:\Program Files (x86)\SME\ total_number_of_bytes: 0		0	0
GetDiskFreeSpaceExW April 24, 2021, 5:54 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13285953536 root_path: C:\Program Files (x86)\ total_number_of_bytes: 34252779520	1	1	0

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-4I3JS.tmp\43f4dab6d5ea1eecee44d7e673ab980a.tmp

File has been identified by 7 AntiVirus engines on VirusTotal as malicious (7 events)

VIPRE	Trojan.Win32.Generic!BT
NANO-Antivirus	Trojan.Win32.Nimnul.exabye
Rising	Trojan.Generic@ML.87 (RDML:DLwrHNOgxyXw7bJ44grFig)
Comodo	Malware@#4r8lljhu74ct
DrWeb	Trojan.MulDrop7.54335
MAX	malware (ai score=95)
Fortinet	W32/Nimnul.YBM!tr

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW April 24, 2021, 5:54 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SMECloudTools_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\SMECloudTools_is1		2	0
RegOpenKeyExW April 24, 2021, 5:54 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SMECloudTools_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SMECloudTools_is1		2	0

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14