Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 20, 2021, 10:01 a.m.	May 20, 2021, 10:07 a.m.

Size	548.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6281865f1e7a60eca71ecce24d777c59`
SHA256	`ab48f4a70238493e3b54a7cd63ad1496c64fdb724035ba1ddb23d804a390c596`
CRC32	`7FAFF4A1`
ssdeep	`6144:axtzCOPmY0cdPlXmIbtK1O2rf4ORJwGmd/T7xvoldaoAxKiYeRSvA5UamZ6L9GQv:RoPl2nZTHJLmV7B+AciMemZ6t`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

H2AymTOp.txt "C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt"
8768
- H2AymTOp.txt "C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt"
  5656
  - schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp30E7.tmp"
    3752

Name	Response	Post-Analysis Lookup
wealthybillionaire.ddns.net	A 41.217.58.202	41.217.58.202
www.google.com	A 142.250.204.36	172.217.175.100

IP Address	Status	Action
142.250.204.36	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
41.217.58.202	Active	Moloch
79.134.225.52	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:62461 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
TCP 192.168.56.102:49809 -> 204.79.197.200:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49806 -> 142.250.204.36:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.102:61998 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.102:50839 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.102:54660 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.102:54221 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49809 204.79.197.200:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=www.bing.com	29:b4:ed:e7:1f:1c:1b:12:99:6c:9b:1e:27:75:ac:01:25:15:77:1f
TLSv1 192.168.56.102:49806 142.250.204.36:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=www.google.com	67:e9:c1:b1:15:ca:6f:e9:e7:35:1a:b2:b6:c7:36:06:97:52:e6:ce

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW May 20, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2021, 10:01 a.m.			0	0
IsDebuggerPresent May 20, 2021, 10:01 a.m.			0	0
IsDebuggerPresent May 20, 2021, 10:01 a.m.			0	0
IsDebuggerPresent May 20, 2021, 10:01 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 20, 2021, 10:01 a.m.	buffer: SUCCESS: The scheduled task "SMTP Host" has successfully been created. console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 20, 2021, 10:01 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://www.google.com/
suspicious_features	GET method with no useragent header				suspicious_request	GET https://www.bing.com/

Connects to a Dynamic DNS Domain (1 event)

domain

wealthybillionaire.ddns.net

Performs some HTTP requests (2 events)

request	GET https://www.google.com/
request	GET https://www.bing.com/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 129 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00616000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00617000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00551000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fde000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 15872 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f70400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fdf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f93000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f70178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f701a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f701c8 process_handle: 0xffffffff		3221225550

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (1 event)

cmdline

"schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp30E7.tmp"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 20, 2021, 10:01 a.m.	thread_identifier: 2228 thread_handle: 0x00000268 process_identifier: 3752 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp30E7.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000026c	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 20, 2021, 10:01 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 20, 2021, 10:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 20, 2021, 10:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp30E7.tmp"

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	79.134.225.52

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 5656 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000620	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 20, 2021, 10:01 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

H2AymTOp.txt tried to sleep 4741548028 seconds, actually delayed analysis time by 4741548028 seconds

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp30E7.tmp

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ø_ H.textÇ È `.relocÊ@B.rsrcØ_ `Ì@@ base_address: 0x00400000 process_identifier: 5656 process_handle: 0x00000620	1	1
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: à7 base_address: 0x00420000 process_identifier: 5656 process_handle: 0x00000620	1	1
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 5656 process_handle: 0x00000620	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ø_ H.textÇ È `.relocÊ@B.rsrcØ_ `Ì@@ base_address: 0x00400000 process_identifier: 5656 process_handle: 0x00000620	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8768 called NtSetContextThread to modify thread in remote process 5656
NtSetContextThread May 20, 2021, 10:01 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000618 process_identifier: 5656	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (2 events)

file	C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt:Zone.Identifier
file	C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8768 resumed a thread in remote process 5656
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000618 suspend_count: 1 process_identifier: 5656	1	0	0

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.6281865f1e7a60ec
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.c1866d
Cyren	W32/MSIL_Kryptik.EHM.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AAYJ
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
Ikarus	Trojan.MSIL.Inject
Microsoft	Trojan:Win32/Sabsik.FT.A!ml
Malwarebytes	Malware.AI.1135665864
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.AAYJ!tr
BitDefenderTheta	Gen:NN.ZemsilF.34690.Im0@auFxY4d
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen

Executed a process and injected code into it, probably while unpacking (38 events)

Time & API	Arguments	Status	Return
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000344 suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000005f8 suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 8768	1	0
NtGetContextThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000370 suspend_count: 1 process_identifier: 8768	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x0000061c suspend_count: 1 process_identifier: 8768	1	0
CreateProcessInternalW May 20, 2021, 10:01 a.m.	thread_identifier: 4232 thread_handle: 0x00000618 process_identifier: 5656 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt" filepath_r: C:\Users\test22\AppData\Local\Temp\H2AymTOp.txt stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000620	1	1
NtGetContextThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000618	1	0
NtAllocateVirtualMemory May 20, 2021, 10:01 a.m.	process_identifier: 5656 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000620	1	0
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ø_ H.textÇ È `.relocÊ@B.rsrcØ_ `Ì@@ base_address: 0x00400000 process_identifier: 5656 process_handle: 0x00000620	1	1
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: base_address: 0x00402000 process_identifier: 5656 process_handle: 0x00000620	1	1
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: à7 base_address: 0x00420000 process_identifier: 5656 process_handle: 0x00000620	1	1
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: base_address: 0x00422000 process_identifier: 5656 process_handle: 0x00000620	1	1
WriteProcessMemory May 20, 2021, 10:01 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 5656 process_handle: 0x00000620	1	1
NtSetContextThread May 20, 2021, 10:01 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000618 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000618 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 5656	1	0
CreateProcessInternalW May 20, 2021, 10:01 a.m.	thread_identifier: 2228 thread_handle: 0x00000268 process_identifier: 3752 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp30E7.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000026c	1	1
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000002d8 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000330 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:01 a.m.	thread_handle: 0x000003d0 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:02 a.m.	thread_handle: 0x000003fc suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:02 a.m.	thread_handle: 0x00000418 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:02 a.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:03 a.m.	thread_handle: 0x00000428 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:03 a.m.	thread_handle: 0x00000430 suspend_count: 1 process_identifier: 5656	1	0
NtResumeThread May 20, 2021, 10:03 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 5656	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (8 events)

dead_host	79.134.225.52:5540
dead_host	192.168.56.102:49821
dead_host	192.168.56.102:49817
dead_host	41.217.58.202:5540
dead_host	192.168.56.102:49816
dead_host	192.168.56.102:49822
dead_host	192.168.56.102:49823
dead_host	192.168.56.102:49815

H2AymTOp.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All