Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 18, 2021, 11:30 a.m.	June 18, 2021, 11:32 a.m.

Size	8.8MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`2415c1f7de7b48be235bd153e7eb2470`
SHA256	`26065132cd1008e7160ce9b640f83305a95053b91ae82deadb98c55b551503a3`
CRC32	`AE86AD37`
ssdeep	`196608:WUgSQbaCDWr9U4XYCVx49bgZn8ESbHWJDz+JHYGv:WUd+WZmCr4RSSKJXKHYG`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE64 - (no description)

winhost.exe "C:\Users\test22\AppData\Local\Temp\winhost.exe"
204

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 18, 2021, 11:23 a.m.			0	0
IsDebuggerPresent June 18, 2021, 11:23 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 18, 2021, 11:23 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 18, 2021, 11:23 a.m.	stacktrace: 0x7fe91cc13f0 mscorlib+0x48941c @ 0x7fef022941c CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef136f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef136f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef136f30b CreateHistoryReader+0x8017 StrongNameSignatureVerification-0x321d clr+0x17da6f @ 0x7fef149da6f StrongNameTokenFromPublicKey+0x1d55d SetRuntimeInfo-0x1e3e3 clr+0xb34ad @ 0x7fef13d34ad StrongNameTokenFromPublicKey+0x1d4fa SetRuntimeInfo-0x1e446 clr+0xb344a @ 0x7fef13d344a CreateHistoryReader+0x8273 StrongNameSignatureVerification-0x2fc1 clr+0x17dccb @ 0x7fef149dccb CreateHistoryReader+0x8119 StrongNameSignatureVerification-0x311b clr+0x17db71 @ 0x7fef149db71 CoUninitializeEE+0x677a4 GetMetaDataInternalInterface-0xff78 clr+0x6a948 @ 0x7fef138a948 GetMetaDataInternalInterface+0x6b03 CreateAssemblyNameObject-0xff5d clr+0x813c3 @ 0x7fef13a13c3 GetMetaDataInternalInterface+0x7d22 CreateAssemblyNameObject-0xed3e clr+0x825e2 @ 0x7fef13a25e2 mscorlib+0x48a0ab @ 0x7fef022a0ab mscorlib+0x489aad @ 0x7fef0229aad mscorlib+0x481982 @ 0x7fef0221982 mscorlib+0x481619 @ 0x7fef0221619 mscorlib+0x4812e3 @ 0x7fef02212e3 mscorlib+0x486344 @ 0x7fef0226344 0x7fe91cc10ef 0x7fe91cc0ed2 0x7fe91cc0e54 0x7fe91cc0c54 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef136f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef136f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef136f30b _CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef150721c _CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef1507976 _CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef1507870 _CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef15073e6 _CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef150733e _CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef1503ed4 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef30074e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3805b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521 exception.instruction_r: 80 38 00 48 8b 4d 10 48 8b 55 08 e8 90 d2 50 5e exception.instruction: cmp byte ptr [rax], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe91cc13f0 registers.r14: 0 registers.r15: 0 registers.rcx: 456458426 registers.rsi: 0 registers.r10: 54072752 registers.rbx: 0 registers.rsp: 5307168 registers.r11: 5292688 registers.r8: 54072600 registers.r9: 8791534071896 registers.rdx: 54072600 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 18, 2021, 11:23 a.m.

stacktrace:

0x7fe91cc13f0
mscorlib+0x48941c @ 0x7fef022941c
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef136f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef136f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef136f30b
CreateHistoryReader+0x8017 StrongNameSignatureVerification-0x321d clr+0x17da6f @ 0x7fef149da6f
StrongNameTokenFromPublicKey+0x1d55d SetRuntimeInfo-0x1e3e3 clr+0xb34ad @ 0x7fef13d34ad
StrongNameTokenFromPublicKey+0x1d4fa SetRuntimeInfo-0x1e446 clr+0xb344a @ 0x7fef13d344a
CreateHistoryReader+0x8273 StrongNameSignatureVerification-0x2fc1 clr+0x17dccb @ 0x7fef149dccb
CreateHistoryReader+0x8119 StrongNameSignatureVerification-0x311b clr+0x17db71 @ 0x7fef149db71
CoUninitializeEE+0x677a4 GetMetaDataInternalInterface-0xff78 clr+0x6a948 @ 0x7fef138a948
GetMetaDataInternalInterface+0x6b03 CreateAssemblyNameObject-0xff5d clr+0x813c3 @ 0x7fef13a13c3
GetMetaDataInternalInterface+0x7d22 CreateAssemblyNameObject-0xed3e clr+0x825e2 @ 0x7fef13a25e2
mscorlib+0x48a0ab @ 0x7fef022a0ab
mscorlib+0x489aad @ 0x7fef0229aad
mscorlib+0x481982 @ 0x7fef0221982
mscorlib+0x481619 @ 0x7fef0221619
mscorlib+0x4812e3 @ 0x7fef02212e3
mscorlib+0x486344 @ 0x7fef0226344
0x7fe91cc10ef
0x7fe91cc0ed2
0x7fe91cc0e54
0x7fe91cc0c54
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef136f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef136f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef136f30b
_CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef150721c
_CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef1507976
_CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef1507870
_CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef15073e6
_CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef150733e
_CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef1503ed4
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef30074e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3805b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 80 38 00 48 8b 4d 10 48 8b 55 08 e8 90 d2 50 5e
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe91cc13f0
registers.r14: 0
registers.r15: 0
registers.rcx: 456458426
registers.rsi: 0
registers.r10: 54072752
registers.rbx: 0
registers.rsp: 5307168
registers.r11: 5292688
registers.r8: 54072600
registers.r9: 8791534071896
registers.rdx: 54072600
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91baa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bbd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 11:23 a.m.	process_identifier: 204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x008ce000', u'virtual_address': u'0x00002000', u'entropy': 7.999908852635252, u'name': u'.text', u'virtual_size': u'0x008cdecc'}

entropy

7.99990885264

description

A section with a high entropy has been found

entropy

0.99640824446

description

Overall entropy of this PE file is high

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

MicroWorld-eScan	Trojan.GenericKD.46508468
FireEye	Generic.mg.2415c1f7de7b48be
McAfee	Artemis!2415C1F7DE7B
Cylance	Unsafe
Sangfor	Backdoor.MSIL.Androm.gen
Alibaba	Backdoor:MSIL/AgentTesla.0376a51f
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.ABKG
APEX	Malicious
Avast	Win64:TrojanX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Androm.gen
BitDefender	Trojan.GenericKD.46508468
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.46508468
Sophos	Mal/Generic-S
DrWeb	Trojan.PackedNET.835
TrendMicro	TROJ_GEN.R002C0DFH21
McAfee-GW-Edition	BehavesLike.Win64.Generic.rc
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:MSIL/AgentTesla.WC!MTB
AegisLab	Trojan.MSIL.Androm.m!c
GData	Win64.Trojan.Agent.8S5Q4X
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.4239336068
TrendMicro-HouseCall	TROJ_GEN.R002C0DFH21
Ikarus	Win32.Outbreak
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.ABKG!tr
AVG	Win64:TrojanX-gen [Trj]
Panda	Trj/CI.A

winhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All