Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 26, 2021, 1:37 a.m.	May 26, 2021, 1:39 a.m.

Size	907.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`1b566412e52165a3ef457cc7dd0ecfba`
SHA256	`6268e19575207d818dc693f5cb5f2bf06cc51c31d330f3942a30e8252e1b2a56`
CRC32	`87DD1AE3`
ssdeep	`12288:kJqyFO3ZPGHWB8YixguUiR834xE55hbG0JKeOJ1tXq5oQBVJFlpy:kA3Ze2BbAgREQYQ5hbma5o0f`
PDB Path	C:\Users\Administrator\Desktop\Client\Temp\DpokjiUTYB\src\obj\Debug\ValueTuple.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

ACC.exe "C:\Users\test22\AppData\Local\Temp\ACC.exe"
2216
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\ACC.exe"
  2080

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.111.174.74	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 26, 2021, 1:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 26, 2021, 1:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 26, 2021, 1:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 26, 2021, 1:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 26, 2021, 1:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 26, 2021, 1:39 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 26, 2021, 1:37 a.m.			0	0
IsDebuggerPresent May 26, 2021, 1:37 a.m.			0	0
IsDebuggerPresent May 26, 2021, 1:39 a.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\ACC. console_handle: 0x00000053	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: exe console_handle: 0x0000005f	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 26, 2021, 1:39 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey May 26, 2021, 1:37 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046b148 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:37 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046b0c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:37 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0046b0c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00432c90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00432ad0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00432ad0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00432ad0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433390 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004334d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433810 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2021, 1:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00433750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\Client\Temp\DpokjiUTYB\src\obj\Debug\ValueTuple.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 26, 2021, 1:37 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 213 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:37 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6de82000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05190178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051901a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051901c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0523649e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05236492 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05190208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd20 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd44 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd4c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd50 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd58 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd5c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd60 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd64 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd6c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 26, 2021, 1:39 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0520fd70 process_handle: 0xffffffff		3221225550

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\ACC.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\ACC.exe"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 26, 2021, 1:39 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\ACC.exe" filepath: powershell	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 26, 2021, 1:39 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000de000', u'virtual_address': u'0x00002000', u'entropy': 7.402425504420266, u'name': u'.text', u'virtual_size': u'0x000dde8c'}

entropy

7.40242550442

description

A section with a high entropy has been found

entropy

0.979051819184

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 26, 2021, 1:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

176.111.174.74

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.463570
McAfee	Artemis!1B566412E521
Cylance	Unsafe
Arcabit	Trojan.Bulz.D712D2
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/GenKryptik.FFMW
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Bulz.463570
Ad-Aware	Gen:Variant.Bulz.463570
McAfee-GW-Edition	Artemis
FireEye	Generic.mg.1b566412e52165a3
Emsisoft	Gen:Variant.Bulz.463570 (B)
MAX	malware (ai score=89)
GData	Gen:Variant.Bulz.463570
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.Generic.R415653
BitDefenderTheta	Gen:NN.ZemsilF.34690.4m0@aiKr!Wk
ALYac	Gen:Variant.Bulz.463570
Malwarebytes	Trojan.MalPack.ADC
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Webroot	W32.Malware.Gen
AVG	Win32:RATX-gen [Trj]

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

176.111.174.74:80

ACC.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All