Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 5, 2021, 10:07 a.m.	May 5, 2021, 10:11 a.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`83f9bc0db9a3e0a33ffe239592be398a`
SHA256	`82fc0a861b0d9c8cb886b7a9a75f8050d1d6a015de6c775256b06c21e7e48ce8`
CRC32	`4C11604D`
ssdeep	`49152:jkQTAuIuPZyoybUoAtg+JqIadoXDXt78K/OOQYCp:jauXUowKg/MDdup`
PDB Path
Yara	UltraVNC_Zero - UltraVNC OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature IsPE32 - (no description)

Rina.Client.exe "C:\Users\test22\AppData\Local\Temp\Rina.Client.exe"
4244

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
51.195.61.169	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 5, 2021, 10:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 5, 2021, 10:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 5, 2021, 10:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 5, 2021, 10:07 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 5, 2021, 10:07 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 5, 2021, 10:07 a.m.			0	0
IsDebuggerPresent May 5, 2021, 10:07 a.m.			0	0
IsDebuggerPresent May 5, 2021, 10:07 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (28 events)

Time & API	Arguments	Status	Return
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c65b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c65b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c66b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c7378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c7378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c7378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6e78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6e78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6ef8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c7338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c7338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c7278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6d78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c6eb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c72f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c72f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c72f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 5, 2021, 10:07 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006c72f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 5, 2021, 10:07 a.m.		1	1	0

One or more processes crashed (50 out of 334 events)

Time & API	Arguments	Status
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: rina+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4453820 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 4	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4456384 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10589	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4460480 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10557	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4464576 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10525	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4468672 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10493	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4472768 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10461	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4476864 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10429	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4480960 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10397	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4485056 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10365	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4489152 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10333	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4493248 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10301	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4497344 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10269	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4501440 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10237	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4505536 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10205	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4509632 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10173	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4513728 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10141	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4517824 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10109	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4521920 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10077	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4526016 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10045	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4530112 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 10013	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4534208 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9981	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4538304 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9949	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4542400 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9917	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4546496 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9885	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4550592 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9853	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4554688 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9821	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4558784 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9789	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4562880 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9757	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4566976 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9725	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4571072 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9693	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4575168 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9661	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4579264 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9629	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4583360 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9597	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4587456 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9565	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4591552 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9533	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4595648 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9501	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4599744 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9469	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4603840 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9437	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4607936 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9405	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4612032 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9373	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4616128 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9341	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4620224 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9309	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4624320 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9277	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4628416 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9245	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4632512 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9213	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4636608 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9181	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4640704 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9149	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4644800 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9117	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4648896 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9085	1
__exception__ May 5, 2021, 10:07 a.m.	stacktrace: rina+0xf054 @ 0x40f054 rina+0xf0a0 @ 0x40f0a0 rina+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 exception.symbol: rina+0xeffa exception.address: 0x40effa exception.module: Rina.Client.exe exception.exception_code: 0xc0000005 exception.offset: 61434 registers.esp: 1636940 registers.edi: 4652992 registers.eax: 4453824 registers.ebp: 1636944 registers.edx: 105 registers.ebx: 0 registers.esi: 33685536 registers.ecx: 9053	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://51.195.61.169/data/getip.php
suspicious_features	Connection to IP address	suspicious_request	GET http://51.195.61.169/data/serverip.txt
suspicious_features	Connection to IP address	suspicious_request	GET http://51.195.61.169/data/r_assver.php

Performs some HTTP requests (3 events)

request	GET http://51.195.61.169/data/getip.php
request	GET http://51.195.61.169/data/serverip.txt
request	GET http://51.195.61.169/data/r_assver.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 87 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02420000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02550000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02550000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02362000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02632000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0236a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0236c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02633000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02634000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0239b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02397000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02395000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cc8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02386000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0238a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02387000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cc9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04def000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0237f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 5, 2021, 10:07 a.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Executes one or more WMI queries (3 events)

wmi	Select * FROM WIN32_Processor
wmi	Select * FROM Win32_NetworkAdapterConfiguration
wmi	SELECT ParentProcessId FROM Win32_Process WHERE ProcessId = 4244

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 5, 2021, 10:07 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00165600', u'virtual_address': u'0x00026000', u'entropy': 7.907042700825785, u'name': u'.rsrc', u'virtual_size': u'0x0016542c'}

entropy

7.90704270083

description

A section with a high entropy has been found

entropy

0.913710450623

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 5, 2021, 10:07 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (2 events)

wmi	Select * FROM WIN32_Processor
wmi	Select * FROM Win32_NetworkAdapterConfiguration

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	51.195.61.169

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Dopping.1
FireEye	Generic.mg.83f9bc0db9a3e0a3
McAfee	Artemis!83F9BC0DB9A3
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZexaF.34688.Hr0@aa2P83
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Dopping-9843036-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Dopping.1
Paloalto	generic.ml
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazpLL8HZyI74Nw7vi/n92AFz)
Ad-Aware	Gen:Variant.Dopping.1
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Emsisoft	Gen:Variant.Dopping.1 (B)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1127970
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Dopping.1
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.Reputation.C4359026
ALYac	Gen:Variant.Dopping.1
Malwarebytes	Trojan.MalPack
eGambit	Unsafe.AI_Score_75%
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
MaxSecure	Trojan.Malware.300983.susgen

Rina.Client.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All