Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 28, 2021, 9:22 a.m.	April 28, 2021, 9:27 a.m.

Size	17.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`342d651660cf2b0587d25f343aff786f`
SHA256	`fa84a0c29e5aa8ba804e8cdfaec78f1f642b7de25d89c02ff03a7a75588b4663`
CRC32	`238E789F`
ssdeep	`384:4z/GJAMGr+ncEfvadZ3fflIi+fxYGu0fDREXmXmfJMQ+/7+YoP5Ap5maBmQ:M/GdGb7x+fxYGu0ryWWfJMQ+/7+YoP5i`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) PE_Header_Zero - PE File Signature Zero

mazx.exe "C:\Users\test22\AppData\Local\Temp\mazx.exe"
7092
- cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 1
  7636
  - timeout.exe timeout 1
    6096
- mazx.exe "C:\Users\test22\AppData\Local\Temp\mazx.exe"
  8620

Name	Response	Post-Analysis Lookup
ldvamlwhdpetnyn.ml	A 172.67.208.174 A 104.21.85.176	172.67.208.174

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
172.67.208.174	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:57660 -> 164.124.101.2:53	2025106	ET INFO DNS Query for Suspicious .ml Domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 28, 2021, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:22 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 28, 2021, 9:22 a.m.			0	0
IsDebuggerPresent April 28, 2021, 9:22 a.m.			0	0
IsDebuggerPresent April 28, 2021, 9:22 a.m.			0	0
IsDebuggerPresent April 28, 2021, 9:22 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 28, 2021, 9:22 a.m.	buffer: Waiting for 1 console_handle: 0x00000007	1	1	0
WriteConsoleW April 28, 2021, 9:22 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey April 28, 2021, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043e658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2021, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043e698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2021, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0043e698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d57b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d5630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2021, 9:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d5630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 28, 2021, 9:22 a.m.		1	1	0

One or more processes crashed (7 events)

Time & API	Arguments	Status
__exception__ April 28, 2021, 9:22 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6fd51194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6fc22ba1 mscorlib+0x2f45b0 @ 0x6eed45b0 mscorlib+0x2f74d4 @ 0x6eed74d4 microsoft+0x54d83 @ 0x72054d83 microsoft+0x54b2d @ 0x72054b2d 0x6b0826 0x6b0563 0x6b0088 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1961916 registers.edi: 0 registers.eax: 1961916 registers.ebp: 1961996 registers.edx: 2 registers.ebx: 4826760 registers.esi: 4286480 registers.ecx: 2450706547	1
__exception__ April 28, 2021, 9:22 a.m.	stacktrace: 0xb91790 0xb90fb3 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 93 d7 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb91c03 registers.esp: 3731616 registers.edi: 3731640 registers.eax: 0 registers.ebp: 3731652 registers.edx: 195 registers.ebx: 3731900 registers.esi: 35786864 registers.ecx: 0	1
__exception__ April 28, 2021, 9:24 a.m.	stacktrace: 0xb96fc0 0xb91521 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 38 07 68 ff ff ff 7f 6a 00 8b cf e8 02 f0 2f 64 exception.instruction: cmp byte ptr [edi], al exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb9fcbe registers.esp: 3730352 registers.edi: 0 registers.eax: 36148676 registers.ebp: 3730400 registers.edx: 36148676 registers.ebx: 36147908 registers.esi: 36147872 registers.ecx: 1689995666	1
__exception__ April 28, 2021, 9:24 a.m.	stacktrace: 0xb97165 0xb91521 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 2c ff 50 14 38 00 89 45 cc e9 85 00 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4290921 registers.esp: 3730348 registers.edi: 3730388 registers.eax: 3 registers.ebp: 3730400 registers.edx: 0 registers.ebx: 35965384 registers.esi: 36179968 registers.ecx: 0	1
__exception__ April 28, 2021, 9:24 a.m.	stacktrace: 0xb91521 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 83 78 04 01 0f 9f c0 0f b6 c0 83 7f 04 01 0f 9f exception.instruction: cmp dword ptr [eax + 4], 1 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb97252 registers.esp: 3730408 registers.edi: 36190964 registers.eax: 0 registers.ebp: 3731688 registers.edx: 36190964 registers.ebx: 35965384 registers.esi: 0 registers.ecx: 35267224	1
__exception__ April 28, 2021, 9:24 a.m.	stacktrace: 0xb97713 0xb91521 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 d1 e9 b8 60 89 45 c8 33 d2 89 55 dc 83 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4292114 registers.esp: 3730336 registers.edi: 3730384 registers.eax: 0 registers.ebp: 3730400 registers.edx: 3730304 registers.ebx: 35965384 registers.esi: 0 registers.ecx: 0	1
__exception__ April 28, 2021, 9:24 a.m.	stacktrace: 0xb9798f 0xb91521 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 56 60 b8 60 83 78 04 00 0f 84 3b 02 00 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x429aa8f registers.esp: 3730320 registers.edi: 3730384 registers.eax: 0 registers.ebp: 3730400 registers.edx: 3730288 registers.ebx: 35965384 registers.esi: 0 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-4C040980FB238F42747D4200E39E5134.html
suspicious_features	GET method with no useragent header				suspicious_request	GET http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-E6414DF053ECE16DD340D40A0368921A.html

Performs some HTTP requests (2 events)

request	GET http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-4C040980FB238F42747D4200E39E5134.html
request	GET http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-E6414DF053ECE16DD340D40A0368921A.html

Allocates read-write-execute memory (usually to unpack itself) (50 out of 138 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates a suspicious process (2 events)

cmdline	cmd.exe /c timeout 1
cmdline	"C:\Windows\System32\cmd.exe" /c timeout 1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 28, 2021, 9:22 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c timeout 1 filepath: cmd.exe	1	1	0

Moves the original executable to a new location (2 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW April 28, 2021, 9:22 a.m.	newfilepath_r: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc.\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\user.config flags: 1 oldfilepath_r: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\a0ge5ywa.newcfg newfilepath: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\user.config oldfilepath: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\a0ge5ywa.newcfg	1	1	0
MoveFileWithProgressW April 28, 2021, 9:22 a.m.	newfilepath_r: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc.\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\user.config flags: 1 oldfilepath_r: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\45ijnfsy.newcfg newfilepath: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\user.config oldfilepath: C:\Users\test22\AppData\Local\柑柘栆栂栐栗栁柣柷柕_Inc\mazx.exe_Url_u03rti0hiw425amgogqqxre4p0spnbru\2.78.996.560\45ijnfsy.newcfg	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 28, 2021, 9:22 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 28, 2021, 9:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW April 28, 2021, 9:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Communications smtp	rule	network_smtp_dotNet
description	Run a keylogger	rule	keylogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess April 28, 2021, 9:22 a.m.	status_code: 0xffffffff process_identifier: 8064 process_handle: 0x000004cc		0	0
NtTerminateProcess April 28, 2021, 9:22 a.m.	status_code: 0xffffffff process_identifier: 8064 process_handle: 0x000004cc	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 8064 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004c4		3221225496	0
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 8620 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004bc	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 28, 2021, 9:22 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

mazx.exe tried to sleep 13641049 seconds, actually delayed analysis time by 13641049 seconds

Harvests credentials from local FTP client softwares (5 events)

file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7092 manipulating memory of non-child process 8064
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 8064 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004c4		3221225496	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELd`àX®w @ À@TwWÀ H.text´W X `.rsrcÀZ@@.reloc ^@B base_address: 0x00400000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: 0 HXhäh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsTlTX PKPy(CompanyNameKTo8FileDescriptionYhQ IDm0FileVersion7.1.0.4: InternalNameIvdv KTS.exez+LegalCopyrightCopyright 2020 © WMS. All rights reserved.2LegalTrademarksGWNpB OriginalFilenameIvdv KTS.exe2 ProductNameIvdv KTS4ProductVersion7.0.2.28Assembly Version7.0.2.2DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING base_address: 0x00438000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: p°7 base_address: 0x0043a000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 8620 process_handle: 0x000004bc	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELd`àX®w @ À@TwWÀ H.text´W X `.rsrcÀZ@@.reloc ^@B base_address: 0x00400000 process_identifier: 8620 process_handle: 0x000004bc	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW April 28, 2021, 9:24 a.m.	thread_identifier: 0 callback_function: 0x005a13ea hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	525437	0

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	Trojan:MSIL/Generic.516f301d
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HVE
APEX	Malicious
Kaspersky	UDS:Trojan-PSW.MSIL.Agensla.gen
Avast	FileRepMalware
McAfee-GW-Edition	Artemis!Trojan
Ikarus	Trojan.Inject
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
AegisLab	Trojan.MSIL.Agensla.i!c
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:MSIL/Agensla.GE!MTB
McAfee	Artemis!342D651660CF
Rising	Downloader.Agent!8.B23 (CLOUD)
SentinelOne	Static AI - Malicious PE
BitDefenderTheta	Gen:NN.ZemsilCO.34684.bm0@a8uD5Odi
AVG	FileRepMalware

Harvests credentials from local email clients (5 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7092 called NtSetContextThread to modify thread in remote process 8620
NtSetContextThread April 28, 2021, 9:22 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421550 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004cc process_identifier: 8620	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 7092 resumed a thread in remote process 8620
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000004cc suspend_count: 1 process_identifier: 8620	1	0	0

Executed a process and injected code into it, probably while unpacking (49 events)

Time & API	Arguments	Status	Return
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 7092	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 7092	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000001d0 suspend_count: 1 process_identifier: 7092	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000003dc suspend_count: 1 process_identifier: 7092	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 7092	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 7092	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 7092	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread April 28, 2021, 9:22 a.m.	registers.eip: 1874996100 registers.esp: 1962124 registers.edi: 38139368 registers.eax: 3276832 registers.ebp: 1962128 registers.edx: 100478176 registers.ebx: 0 registers.esi: 873637 registers.ecx: 102928376 thread_handle: 0x000000e4 process_identifier: 7092	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 7092	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 7092	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 7092	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 7092	1	0
CreateProcessInternalW April 28, 2021, 9:22 a.m.	thread_identifier: 7400 thread_handle: 0x000004d4 process_identifier: 7636 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c timeout 1 filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004d8	1	1
CreateProcessInternalW April 28, 2021, 9:22 a.m.	thread_identifier: 7072 thread_handle: 0x000004c8 process_identifier: 8064 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mazx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mazx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000004c4	1	1
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000004c8	1	0
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 8064 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004c4		3221225496
CreateProcessInternalW April 28, 2021, 9:22 a.m.	thread_identifier: 3388 thread_handle: 0x000004cc process_identifier: 8620 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mazx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mazx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000004bc	1	1
NtGetContextThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000004cc	1	0
NtAllocateVirtualMemory April 28, 2021, 9:22 a.m.	process_identifier: 8620 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004bc	1	0
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELd`àX®w @ À@TwWÀ H.text´W X `.rsrcÀZ@@.reloc ^@B base_address: 0x00400000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: base_address: 0x00402000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: 0 HXhäh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsTlTX PKPy(CompanyNameKTo8FileDescriptionYhQ IDm0FileVersion7.1.0.4: InternalNameIvdv KTS.exez+LegalCopyrightCopyright 2020 © WMS. All rights reserved.2LegalTrademarksGWNpB OriginalFilenameIvdv KTS.exe2 ProductNameIvdv KTS4ProductVersion7.0.2.28Assembly Version7.0.2.2DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING base_address: 0x00438000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: p°7 base_address: 0x0043a000 process_identifier: 8620 process_handle: 0x000004bc	1	1
WriteProcessMemory April 28, 2021, 9:22 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 8620 process_handle: 0x000004bc	1	1
NtSetContextThread April 28, 2021, 9:22 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4421550 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004cc process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000004cc suspend_count: 1 process_identifier: 8620	1	0
CreateProcessInternalW April 28, 2021, 9:22 a.m.	thread_identifier: 8956 thread_handle: 0x00000084 process_identifier: 6096 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 1 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x0000031c suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:22 a.m.	thread_handle: 0x00000418 suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:23 a.m.	thread_handle: 0x00000344 suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:23 a.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:23 a.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 8620	1	0
NtResumeThread April 28, 2021, 9:24 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 8620	1	0

mazx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All