Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 16, 2021, 9:01 a.m.	June 16, 2021, 9:07 a.m.

Size	23.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b127f3a9da9a84ab311eeff6917b7bd6`
SHA256	`f4fd51e6e0684d722cfacceb9a3abb8e4c449e96dce19b1f8b47fc8b09abf9df`
CRC32	`BFBF6FEF`
ssdeep	`384:5vrOSKo2KlUgzlMX4hGGBVUUUqUUUUUUUUUUUUdTvULJ0+IeMQqt/UGK8X+uxLeU:trOZtkXBVUUUqUUUUUUUUUUUUdTvYJE5`
PDB Path	C:\Users\Administrator\Desktop\WindowsFormsApplication1\obj\Debug\Expense.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

Expense.exe "C:\Users\test22\AppData\Local\Temp\Expense.exe"
8024
- cmd.exe "C:\Windows\System32\cmd.exe" /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe"
  6012
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\8LmTcKDj8jAa.bat" "
3456
- chcp.com chcp 65001
  2572
- PING.EXE ping -n 10 localhost
  3932
- Expense.exe "C:\Users\test22\AppData\Local\Temp\Expense.exe"
  6652
  - cmd.exe "C:\Windows\System32\cmd.exe" /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe"
    8936
  - Expense.exe "C:\Users\test22\AppData\Local\Temp\Expense.exe"
    808

Name	Response	Post-Analysis Lookup
community-dofus.com	A 31.132.0.67	31.132.0.67
vpnnid.hopto.org	A 194.5.98.38	194.5.98.38

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
31.132.0.67	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:61459 -> 164.124.101.2:53	2028681	ET POLICY DNS Query to DynDNS Domain *.hopto .org	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 16, 2021, 9:01 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 16, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 16, 2021, 9:01 a.m.			0	0
IsDebuggerPresent June 16, 2021, 9:01 a.m.			0	0
IsDebuggerPresent June 16, 2021, 9:02 a.m.			0	0
IsDebuggerPresent June 16, 2021, 9:02 a.m.			0	0
IsDebuggerPresent June 16, 2021, 9:03 a.m.			0	0
IsDebuggerPresent June 16, 2021, 9:03 a.m.			0	0

Command line console output was observed (5 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 16, 2021, 9:01 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW June 16, 2021, 9:02 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW June 16, 2021, 9:02 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW June 16, 2021, 9:02 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1
WriteConsoleW June 16, 2021, 9:02 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (12 events)

Time & API	Arguments	Status	Return
CryptExportKey June 16, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00972ec8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00972f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00972f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00972f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00972f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00972f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00469078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004690b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004690b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00469138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00469138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 16, 2021, 9:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00469138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\WindowsFormsApplication1\obj\Debug\Expense.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 16, 2021, 9:01 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 16, 2021, 9:01 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6fd51194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6fc22ba1 0x5002c4 0x500135 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x6fcf0f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9 0x500097 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 4974696 registers.edi: 0 registers.eax: 4974696 registers.ebp: 4974776 registers.edx: 0 registers.ebx: 10276848 registers.esi: 9721600 registers.ecx: 3028148089	1	0	0
__exception__ June 16, 2021, 9:02 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6f6b1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6f582ba1 0x680280 0x680135 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6f529df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6f529e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6f529efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6f529fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x6f650f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6f51bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6f502ae9 0x680097 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 4056456 registers.edi: 0 registers.eax: 4056456 registers.ebp: 4056536 registers.edx: 0 registers.ebx: 4996256 registers.esi: 4478984 registers.ecx: 3557592934	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 16, 2021, 9:01 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6fd51194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6fc22ba1
0x5002c4
0x500135
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x6fcf0f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9
0x500097
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 4974696
registers.edi: 0
registers.eax: 4974696
registers.ebp: 4974776
registers.edx: 0
registers.ebx: 10276848
registers.esi: 9721600
registers.ecx: 3028148089

__exception__

June 16, 2021, 9:02 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6f6b1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6f582ba1
0x680280
0x680135
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6f529df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6f529e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6f529efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6f529fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x6f650f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6f51bcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6f502ae9
0x680097
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 4056456
registers.edi: 0
registers.eax: 4056456
registers.ebp: 4056536
registers.edx: 0
registers.ebx: 4996256
registers.esi: 4478984
registers.ecx: 3557592934

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://community-dofus.com/D(a

Connects to a Dynamic DNS Domain (1 event)

domain

vpnnid.hopto.org

Performs some HTTP requests (1 event)

request

GET http://community-dofus.com/D(a

Allocates read-write-execute memory (usually to unpack itself) (50 out of 161 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02030000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00325000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00327000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00316000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00317000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00318000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00501000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c30178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c301a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c301c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d79dce process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d79dc2 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c30208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58dbc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58ddc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58de4 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58de8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58df0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58df4 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58df8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58dfc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58e04 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58e08 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58e10 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58e14 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58e18 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c58e20 process_handle: 0xffffffff		3221225550

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 16, 2021, 9:01 a.m.	show_type: 0 filepath_r: cmd parameters: /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe" filepath: cmd	1	1	0
ShellExecuteExW June 16, 2021, 9:02 a.m.	show_type: 0 filepath_r: cmd parameters: /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe" filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 16, 2021, 9:01 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 16, 2021, 9:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 16, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (50 out of 57 events)

description	Communications use DNS	rule	Network_DNS
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	Run a KeyLogger	rule	KeyLogger
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications use DNS	rule	Network_DNS
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	Run a KeyLogger	rule	KeyLogger
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 16, 2021, 9:03 a.m.	status_code: 0xffffffff process_identifier: 3404 process_handle: 0x00000570		0	0
NtTerminateProcess June 16, 2021, 9:03 a.m.	status_code: 0xffffffff process_identifier: 3404 process_handle: 0x00000570	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	chcp 65001
cmdline	ping -n 10 localhost

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 7236 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000550	1	0
NtAllocateVirtualMemory June 16, 2021, 9:03 a.m.	process_identifier: 3404 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000568		3221225496
NtAllocateVirtualMemory June 16, 2021, 9:03 a.m.	process_identifier: 808 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000056c	1	0

Attempts to identify installed AV products by installation directory (9 events)

file	C:\Program Files\AVAST Software\Avast\avastUI.exe
file	C:\Program Files (x86)\AVAST Software\Avast\avastUI.exe
file	C:\Program Files\Kaspersky Lab
file	C:\Program Files (x86)\Kaspersky Lab
file	C:\Program Files\McAfee\Agent
file	C:\Program Files\Trend Micro
file	C:\Program Files (x86)\Trend Micro
file	C:\Program Files\AVG\Antivirus\AVGUI.exe
file	C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe

Executes one or more WMI queries (1 event)

wmi	SELECT * FROM AntiVirusProduct

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8024 manipulating memory of non-child process 7236
Process injection	Process 6652 manipulating memory of non-child process 3404
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 7236 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000550	1	0	0
NtAllocateVirtualMemory June 16, 2021, 9:03 a.m.	process_identifier: 3404 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000568		3221225496	0

Potential code injection by writing to the memory of another process (9 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8024 injected into non-child 7236
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0 `à,,.K, @ ,@ÜJ,O`,¾ , H.text4+, ,, `.rsrc¾ `,.,@@.reloc,:,@B base_address: 0x00400000 process_identifier: 7236 process_handle: 0x00000550	1	1	0
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: 8Ph `,¼c,4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°\|StringFileInfoX000004b0Comments"CompanyNameDFileDescriptionQuasar Client,FileVersion1.4.06InternalNameClient.exeTLegalCopyrightCopyright © MaxXor 2020LegalTrademarks>OriginalFilenameClient.exe.ProductNameQuasar0ProductVersion1.4.08Assembly Version1.4.0.0ï»¿<?xml version="1.0" encoding="utf-8"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <application xmlns="urn:schemas-microsoft-com:asm.v3"> <windowsSettings> <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness> <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> </windowsSettings> </application> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> </assembly> base_address: 0x006c6000 process_identifier: 7236 process_handle: 0x00000550	1	1	0
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: @,0; base_address: 0x006c8000 process_identifier: 7236 process_handle: 0x00000550	1	1	0
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 7236 process_handle: 0x00000550	1	1	0
WriteProcessMemory June 16, 2021, 9:03 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0 `à,,.K, @ ,@ÜJ,O`,¾ , H.text4+, ,, `.rsrc¾ `,.,@@.reloc,:,@B base_address: 0x00400000 process_identifier: 808 process_handle: 0x0000056c	1	1	0
WriteProcessMemory June 16, 2021, 9:03 a.m.	buffer: 8Ph `,¼c,4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°\|StringFileInfoX000004b0Comments"CompanyNameDFileDescriptionQuasar Client,FileVersion1.4.06InternalNameClient.exeTLegalCopyrightCopyright © MaxXor 2020LegalTrademarks>OriginalFilenameClient.exe.ProductNameQuasar0ProductVersion1.4.08Assembly Version1.4.0.0ï»¿<?xml version="1.0" encoding="utf-8"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <application xmlns="urn:schemas-microsoft-com:asm.v3"> <windowsSettings> <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness> <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> </windowsSettings> </application> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> </assembly> base_address: 0x006c6000 process_identifier: 808 process_handle: 0x0000056c	1	1	0
WriteProcessMemory June 16, 2021, 9:03 a.m.	buffer: @,0; base_address: 0x006c8000 process_identifier: 808 process_handle: 0x0000056c	1	1	0
WriteProcessMemory June 16, 2021, 9:03 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 808 process_handle: 0x0000056c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8024 injected into non-child 7236
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0 `à,,.K, @ ,@ÜJ,O`,¾ , H.text4+, ,, `.rsrc¾ `,.,@@.reloc,:,@B base_address: 0x00400000 process_identifier: 7236 process_handle: 0x00000550	1	1	0
WriteProcessMemory June 16, 2021, 9:03 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0 `à,,.K, @ ,@ÜJ,O`,¾ , H.text4+, ,, `.rsrc¾ `,.,@@.reloc,:,@B base_address: 0x00400000 process_identifier: 808 process_handle: 0x0000056c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8024 called NtSetContextThread to modify thread in remote process 7236
Process injection	Process 6652 called NtSetContextThread to modify thread in remote process 808
NtSetContextThread June 16, 2021, 9:01 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 7097134 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000548 process_identifier: 7236	1	0	0
NtSetContextThread June 16, 2021, 9:03 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 7097134 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000570 process_identifier: 808	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 8024 resumed a thread in remote process 7236
Process injection	Process 3456 resumed a thread in remote process 6652
Process injection	Process 6652 resumed a thread in remote process 808
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000548 suspend_count: 1 process_identifier: 7236	1	0	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 6652	1	0	0
NtResumeThread June 16, 2021, 9:03 a.m.	thread_handle: 0x00000570 suspend_count: 1 process_identifier: 808	1	0	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

MicroWorld-eScan	Trojan.GenericKD.37088973
FireEye	Trojan.GenericKD.37088973
ALYac	Trojan.GenericKD.37088973
Sangfor	Riskware.Win32.Agent.ky
Alibaba	Trojan:MSIL/Quasar.6a266a6e
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.MSIL.Quasar.gen
BitDefender	Trojan.GenericKD.37088973
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Ad-Aware	Trojan.GenericKD.37088973
Emsisoft	Trojan.GenericKD.37088973 (B)
McAfee-GW-Edition	RDN/Generic.dx
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.37088973
McAfee	RDN/Generic.dx
MAX	malware (ai score=82)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Malicious_Behavior.SBX
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A

Executed a process and injected code into it, probably while unpacking (50 out of 62 events)

Time & API	Arguments	Status	Return
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 8024	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 8024	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 8024	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 8024	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 8024	1	0
NtGetContextThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread June 16, 2021, 9:01 a.m.	registers.eip: 1874996100 registers.esp: 4974904 registers.edi: 4974948 registers.eax: 0 registers.ebp: 4974964 registers.edx: 161 registers.ebx: 3 registers.esi: 0 registers.ecx: 256 thread_handle: 0x000000e0 process_identifier: 8024	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 8024	1	0
NtGetContextThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 8024	1	0
CreateProcessInternalW June 16, 2021, 9:01 a.m.	thread_identifier: 8752 thread_handle: 0x000004ec process_identifier: 6012 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004f4	1	1
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 8024	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000504 suspend_count: 1 process_identifier: 8024	1	0
CreateProcessInternalW June 16, 2021, 9:01 a.m.	thread_identifier: 4836 thread_handle: 0x00000548 process_identifier: 7236 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Expense.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Expense.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000550	1	1
NtGetContextThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000548	1	0
NtAllocateVirtualMemory June 16, 2021, 9:01 a.m.	process_identifier: 7236 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000550	1	0
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0 `à,,.K, @ ,@ÜJ,O`,¾ , H.text4+, ,, `.rsrc¾ `,.,@@.reloc,:,@B base_address: 0x00400000 process_identifier: 7236 process_handle: 0x00000550	1	1
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: base_address: 0x00402000 process_identifier: 7236 process_handle: 0x00000550	1	1
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: 8Ph `,¼c,4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°\|StringFileInfoX000004b0Comments"CompanyNameDFileDescriptionQuasar Client,FileVersion1.4.06InternalNameClient.exeTLegalCopyrightCopyright © MaxXor 2020LegalTrademarks>OriginalFilenameClient.exe.ProductNameQuasar0ProductVersion1.4.08Assembly Version1.4.0.0ï»¿<?xml version="1.0" encoding="utf-8"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <application xmlns="urn:schemas-microsoft-com:asm.v3"> <windowsSettings> <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness> <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> </windowsSettings> </application> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> </assembly> base_address: 0x006c6000 process_identifier: 7236 process_handle: 0x00000550	1	1
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: @,0; base_address: 0x006c8000 process_identifier: 7236 process_handle: 0x00000550	1	1
WriteProcessMemory June 16, 2021, 9:01 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 7236 process_handle: 0x00000550	1	1
NtSetContextThread June 16, 2021, 9:01 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 7097134 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000548 process_identifier: 7236	1	0
NtResumeThread June 16, 2021, 9:01 a.m.	thread_handle: 0x00000548 suspend_count: 1 process_identifier: 7236	1	0
CreateProcessInternalW June 16, 2021, 9:02 a.m.	thread_identifier: 4440 thread_handle: 0x00000088 process_identifier: 2572 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\chcp.com track: 1 command_line: chcp 65001 filepath_r: C:\Windows\system32\chcp.com stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000084	1	1
CreateProcessInternalW June 16, 2021, 9:02 a.m.	thread_identifier: 6440 thread_handle: 0x00000088 process_identifier: 3932 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping -n 10 localhost filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW June 16, 2021, 9:02 a.m.	thread_identifier: 6688 thread_handle: 0x00000084 process_identifier: 6652 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Expense.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\Expense.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\Expense.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000001c0 suspend_count: 1 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x0000034c suspend_count: 1 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000003bc suspend_count: 1 process_identifier: 6652	1	0
NtGetContextThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread June 16, 2021, 9:02 a.m.	registers.eip: 1868049284 registers.esp: 4056664 registers.edi: 4056708 registers.eax: 97 registers.ebp: 4056724 registers.edx: 2 registers.ebx: 3 registers.esi: 0 registers.ecx: 97 thread_handle: 0x000000e0 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 6652	1	0
NtGetContextThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 6652	1	0
CreateProcessInternalW June 16, 2021, 9:02 a.m.	thread_identifier: 6316 thread_handle: 0x000004f8 process_identifier: 8936 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c Copy "C:\Users\test22\AppData\Local\Temp\Expense.exe" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Expense.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000500	1	1
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x000004b4 suspend_count: 1 process_identifier: 6652	1	0
NtResumeThread June 16, 2021, 9:02 a.m.	thread_handle: 0x00000510 suspend_count: 1 process_identifier: 6652	1	0
CreateProcessInternalW June 16, 2021, 9:03 a.m.	thread_identifier: 5176 thread_handle: 0x00000560 process_identifier: 3404 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Expense.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Expense.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000568	1	1
NtGetContextThread June 16, 2021, 9:03 a.m.	thread_handle: 0x00000560	1	0
NtAllocateVirtualMemory June 16, 2021, 9:03 a.m.	process_identifier: 3404 region_size: 2924544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000568		3221225496
CreateProcessInternalW June 16, 2021, 9:03 a.m.	thread_identifier: 4684 thread_handle: 0x00000570 process_identifier: 808 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Expense.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Expense.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000056c	1	1

Expense.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All