Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 18, 2021, 9:44 a.m.	June 18, 2021, 9:46 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`63dcb28db1ff4d702e97a1fa3e9ac02d`
SHA256	`014353b67e4c5ade04926afb6864217fdf38bd826fc8d6b7def96579f35635b7`
CRC32	`E8B33895`
ssdeep	`24576:hAgY4mLd78bcL/p8QevR7HUFoubFtv1ct74zHRiPI1XNX:ho78UWLHVuhxzxiPI1`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

cmd.exe "C:\Users\test22\AppData\Local\Temp\cmd.exe"
1836

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (15 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 9:44 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 18, 2021, 9:44 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey June 18, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000011f6e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 18, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000011f6e90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 18, 2021, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000011f6d40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 18, 2021, 9:44 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 18, 2021, 9:44 a.m.	stacktrace: 0x7ff0019053b 0x7ff0018da73 0x7ff0018c0f4 0x7ff0018bbc9 IEE+0xda16 GetUserStore-0xa7e mscorwks+0x2c1612 @ 0x7fef25e1612 CreateAssemblyNameObject+0x5cbb CompareAssemblyIdentity-0x6ff9 mscorwks+0x1eee13 @ 0x7fef250ee13 PreBindAssembly+0x79a91 LoadStringRC-0x2544f mscorwks+0x69bc51 @ 0x7fef29bbc51 GetCLRFunction+0xccaf CreateApplicationContext-0xa211 mscorwks+0x117dc7 @ 0x7fef2437dc7 StrongNameErrorInfo-0x31f0 mscorwks+0xf4118 @ 0x7fef2414118 GetAssemblyIdentityFromFile+0x195bd LegacyNGenFreeZapper-0x17af3 mscorwks+0x787e3d @ 0x7fef2aa7e3d StrongNameErrorInfo-0x10ded mscorwks+0xe651b @ 0x7fef240651b _CorExeMain+0xac GetCLRFunction-0x72b8 mscorwks+0x103e60 @ 0x7fef2423e60 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3cd74e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3eb5b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521 exception.instruction_r: 49 8b 03 49 8b cb ff 50 40 48 8b c8 e8 54 61 73 exception.instruction: mov rax, qword ptr [r11] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7ff0019053b registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 24608 registers.rbx: 0 registers.rsp: 2292096 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rdx: 8791578436952 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 18, 2021, 9:44 a.m.

stacktrace:

0x7ff0019053b
0x7ff0018da73
0x7ff0018c0f4
0x7ff0018bbc9
IEE+0xda16 GetUserStore-0xa7e mscorwks+0x2c1612 @ 0x7fef25e1612
CreateAssemblyNameObject+0x5cbb CompareAssemblyIdentity-0x6ff9 mscorwks+0x1eee13 @ 0x7fef250ee13
PreBindAssembly+0x79a91 LoadStringRC-0x2544f mscorwks+0x69bc51 @ 0x7fef29bbc51
GetCLRFunction+0xccaf CreateApplicationContext-0xa211 mscorwks+0x117dc7 @ 0x7fef2437dc7
StrongNameErrorInfo-0x31f0 mscorwks+0xf4118 @ 0x7fef2414118
GetAssemblyIdentityFromFile+0x195bd LegacyNGenFreeZapper-0x17af3 mscorwks+0x787e3d @ 0x7fef2aa7e3d
StrongNameErrorInfo-0x10ded mscorwks+0xe651b @ 0x7fef240651b
_CorExeMain+0xac GetCLRFunction-0x72b8 mscorwks+0x103e60 @ 0x7fef2423e60
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3cd74e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3eb5b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 49 8b 03 49 8b cb ff 50 40 48 8b c8 e8 54 61 73
exception.instruction: mov rax, qword ptr [r11]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7ff0019053b
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 24608
registers.rbx: 0
registers.rsp: 2292096
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rdx: 8791578436952
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 111 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2361000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25de000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00045000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00046000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00181000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001350000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001350000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001350000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001352000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000147d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000147d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000147d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:44 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000147d000 process_handle: 0xffffffffffffffff	1

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\cmdt.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 18, 2021, 9:44 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00146e00', u'virtual_address': u'0x00002000', u'entropy': 7.882900712793483, u'name': u'.text', u'virtual_size': u'0x00146dc4'}

entropy

7.88290071279

description

A section with a high entropy has been found

entropy

0.999235766144

description

Overall entropy of this PE file is high

Executes one or more WMI queries which can be used to identify virtual machines (4 events)

wmi	SELECT ProcessorID FROM Win32_Processor
wmi	Select * from Win32_Processor
wmi	SELECT VolumeSerialNumber FROM Win32_LogicalDisk WHERE DeviceID='C:'
wmi	SELECT SerialNumber FROM Win32_BIOS

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Executes one or more WMI queries (8 events)

wmi	SELECT SerialNumber FROM Win32_BaseBoard
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT SerialNumber FROM Win32_BIOS
wmi	SELECT * FROM FirewallProduct
wmi	SELECT VolumeSerialNumber FROM Win32_LogicalDisk WHERE DeviceID='C:'
wmi	SELECT ProcessorID FROM Win32_Processor
wmi	Select * from Win32_Processor

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader23.50673
MicroWorld-eScan	Gen:Variant.Ransom.Generic.1
FireEye	Generic.mg.63dcb28db1ff4d70
CAT-QuickHeal	Trojan.GenericFC.S8706676
McAfee	GenericRXBG-CS!63DCB28DB1FF
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
K7GW	Trojan ( 700000121 )
Cybereason	malicious.db1ff4
BitDefenderTheta	Gen:NN.ZemsilF.34738.rnW@a8qmB3k
Symantec	Trojan Horse
ESET-NOD32	a variant of MSIL/Zyklon.C
APEX	Malicious
Avast	MSIL:Agent-DRV [Trj]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ransom.Generic.1
Ad-Aware	Gen:Variant.Ransom.Generic.1
Emsisoft	Gen:Variant.Ransom.Generic.1 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	ML/PE-A + Mal/MSIL-AZ
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Generic.apsut
Avira	TR/Dropper.Gen
MAX	malware (ai score=85)
Microsoft	Backdoor:MSIL/Omaneat.B
GData	MSIL.Trojan.Zyklon.A
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win32.Skeeyah.R194230
Malwarebytes	Backdoor.Zyklon
Rising	Backdoor.Zyklon!1.CB43 (CLASSIC)
Ikarus	Trojan.MSIL.Zyklon
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Generic.AP.57260!tr
AVG	MSIL:Agent-DRV [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen

cmd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All