195145.exe

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA April 28, 2021, 7:39 a.m.	computer_name: TEST22-PC	1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST http://dimentos.com/btn_bg

Performs some HTTP requests (2 events)

request	GET http://dimentos.com/bg
request	POST http://dimentos.com/btn_bg

Sends data using the HTTP POST Method (1 event)

request

POST http://dimentos.com/btn_bg

A process attempted to delay the analysis task. (1 event)

description

195145.exe tried to sleep 209 seconds, actually delayed analysis time by 209 seconds

Creates a suspicious process (1 event)

cmdline

cmd.exe /c echo NGAtoDgLpvgJwPLEPFdj>"C:\Users\test22\AppData\Local\Temp\DEMFE9C.tmp"&exit

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 28, 2021, 7:39 a.m.	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 262144 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000006c0000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	192.99.178.145

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\DEMFE9C.tmp

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.5b5a730628dc9eba
Cylance	Unsafe
Symantec	Trojan.Gen.2
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Cobalt.vho
TrendMicro	Trojan.Win64.SMOKELOADER.SM
Webroot	W32.Malware.Gen
TrendMicro-HouseCall	Trojan.Win64.SMOKELOADER.SM
Rising	Trojan.Cobalt!8.C4EF (CLOUD)