Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 9, 2021, 6:15 p.m.	July 9, 2021, 6:28 p.m.

Size	382.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d34220b859ea98b86761794b9e581d53`
SHA256	`43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1`
CRC32	`9A99881A`
ssdeep	`6144:ctnDuqI8uCJjuCn6iQUB8CHPku8TvKNK6KSKBuv5IpM8XLXpchuoHUbwUotsLCli:CW8uCJjuCn6iQUB8CHPku8TvKNK6KSKr`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature

PL_0260_63_108_117.exe "C:\Users\test22\AppData\Local\Temp\PL_0260_63_108_117.exe"
2388
- PL_0260_63_108_117.exe C:\Users\test22\AppData\Local\Temp\PL_0260_63_108_117.exe
  2976

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
209.141.34.39	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:17 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 9, 2021, 6:15 p.m.			0	0
IsDebuggerPresent July 9, 2021, 6:15 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 9, 2021, 6:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ce438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ce3b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ce3b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 9, 2021, 6:15 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 9, 2021, 6:16 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x5e1b5ed 0x5e1b562 0x5e18eda 0x5e1827b 0x5e10788 0x4a60c3f system+0x1d3f63 @ 0x706f3f63 0x6c1c17 0x6c1ab6 0x6c1703 system+0x19c522 @ 0x710fc522 system+0x19e920 @ 0x710fe920 system+0x19e803 @ 0x710fe803 0x6c0735 system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x53a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0x6c0084 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 3925240 registers.edi: 1978982344 registers.eax: 15400960 registers.ebp: 3925444 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1	0	0
__exception__ July 9, 2021, 6:16 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x5e1b5ed 0x5e1b562 0x5e18eda 0x5e1827b 0x5e10788 0x4a60c3f system+0x1d3f63 @ 0x706f3f63 0x6c1c17 0x6c1ab6 0x6c1703 system+0x19c522 @ 0x710fc522 system+0x19e920 @ 0x710fe920 system+0x19e803 @ 0x710fe803 0x6c0735 system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x53a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0x6c0084 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 3925240 registers.edi: 1978982344 registers.eax: 15400960 registers.ebp: 3925444 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 9, 2021, 6:16 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e
0x5e1b5ed
0x5e1b562
0x5e18eda
0x5e1827b
0x5e10788
0x4a60c3f
system+0x1d3f63 @ 0x706f3f63
0x6c1c17
0x6c1ab6
0x6c1703
system+0x19c522 @ 0x710fc522
system+0x19e920 @ 0x710fe920
system+0x19e803 @ 0x710fe803
0x6c0735
system+0x1f9799 @ 0x71159799
system+0x1f92c8 @ 0x711592c8
system+0x1eca74 @ 0x7114ca74
system+0x1ec868 @ 0x7114c868
system+0x1f82b8 @ 0x711582b8
system+0x1ee54d @ 0x7114e54d
system+0x1f70ea @ 0x711570ea
system+0x1e56c0 @ 0x711456c0
system+0x1f8215 @ 0x71158215
system+0x1f6f75 @ 0x71156f75
system+0x1ee251 @ 0x7114e251
system+0x1ee229 @ 0x7114e229
system+0x1ee170 @ 0x7114e170
0x53a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a
system+0x1ebc85 @ 0x7114bc85
system+0x1f683b @ 0x7115683b
system+0x1a5e44 @ 0x71105e44
system+0x1fd8a0 @ 0x7115d8a0
system+0x1fd792 @ 0x7115d792
system+0x1a14bd @ 0x711014bd
0x6c0084
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x75b5b479
registers.esp: 3925240
registers.edi: 1978982344
registers.eax: 15400960
registers.ebp: 3925444
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

July 9, 2021, 6:16 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e
0x5e1b5ed
0x5e1b562
0x5e18eda
0x5e1827b
0x5e10788
0x4a60c3f
system+0x1d3f63 @ 0x706f3f63
0x6c1c17
0x6c1ab6
0x6c1703
system+0x19c522 @ 0x710fc522
system+0x19e920 @ 0x710fe920
system+0x19e803 @ 0x710fe803
0x6c0735
system+0x1f9799 @ 0x71159799
system+0x1f92c8 @ 0x711592c8
system+0x1eca74 @ 0x7114ca74
system+0x1ec868 @ 0x7114c868
system+0x1f82b8 @ 0x711582b8
system+0x1ee54d @ 0x7114e54d
system+0x1f70ea @ 0x711570ea
system+0x1e56c0 @ 0x711456c0
system+0x1f8215 @ 0x71158215
system+0x1f6f75 @ 0x71156f75
system+0x1ee251 @ 0x7114e251
system+0x1ee229 @ 0x7114e229
system+0x1ee170 @ 0x7114e170
0x53a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a
system+0x1ebc85 @ 0x7114bc85
system+0x1f683b @ 0x7115683b
system+0x1a5e44 @ 0x71105e44
system+0x1fd8a0 @ 0x7115d8a0
system+0x1fd792 @ 0x7115d792
system+0x1a14bd @ 0x711014bd
0x6c0084
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74081000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74082000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70ea2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a6f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x063d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06aa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06aaf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW July 9, 2021, 6:16 p.m.	number_of_free_clusters: 3063613 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW July 9, 2021, 6:16 p.m.	number_of_free_clusters: 3063613 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Steals private information from local Internet browsers (19 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005ae00', u'virtual_address': u'0x00002000', u'entropy': 7.868626708551101, u'name': u'.text', u'virtual_size': u'0x0005ae00'}

entropy

7.86862670855

description

A section with a high entropy has been found

entropy

0.951570680628

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 9, 2021, 6:15 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 9, 2021, 6:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 65 events)

url	https://github.githubassets.com/assets/chunk-metric-selection-element-45db9a2c.js
url	https://github.githubassets.com/assets/chunk-invitations-966a2c1b.js
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/archive/7fcc4aed117517be1f7c7ac7dde768ac98a3c266.zip
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/raw/7fcc4aed117517be1f7c7ac7dde768ac98a3c266/modernizing-csharp9.md
url	https://github.githubassets.com/assets/chunk-filter-input-62b45627.js
url	https://github.githubassets.com/assets/chunk-contributions-spider-graph-3f6f54d2.js
url	https://github.githubassets.com/assets/chunk-drag-drop-ea3fe848.js
url	https://github.githubassets.com/assets/chunk-profile-pins-element-99ad0e3b.js
url	https://github.com/
url	https://gist.github.com/discover
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/forks
url	http://www.ibsensoftware.com/
url	https://github.githubassets.com/assets/chunk-codemirror-d0c668af.js
url	https://github-cloud.s3.amazonaws.com/
url	https://github.githubassets.com/assets/chunk-insights-graph-675c1cc8.js
url	https://github.githubassets.com/assets/chunk-three.module-9ca6b751.js
url	https://github.githubassets.com/assets/chunk-user-status-submit-50e14d5b.js
url	https://github.githubassets.com/assets/chunk-severity-calculator-element-b64efa7a.js
url	https://api.github.com/_private/browser/optimizely_client/errors
url	https://github.githubassets.com/assets/chunk-jump-to-e0cc4642.js
url	https://avatars.githubusercontent.com/
url	https://gist.github.com/richlander
url	http://schema.org/Code
url	https://github.githubassets.com/assets/chunk-emoji-picker-element-6a2a8c20.js
url	https://docs.microsoft.com/dotnet/api/system.diagnostics.codeanalysis.notnullwhenattribute
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de.js
url	https://github.githubassets.com/assets/chunk-edit-hook-secret-element-55249df9.js
url	https://desktop.github.com/
url	https://gist.github.com/search
url	https://user-images.githubusercontent.com/
url	https://github.githubassets.com/assets/chunk-tweetsodium-d6f499bf.js
url	https://gist.github.com/richlander.atom
url	https://github.githubassets.com/assets/chunk-readme-toc-element-7663f4a6.js
url	https://github.githubassets.com/assets/chunk-launch-code-element-56d75ac0.js
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/stargazers
url	https://api.github.com/_private/browser/errors
url	https://github.githubassets.com/assets/chunk-profile-860a1228.js
url	https://gist.github.com/fluidicon.png
url	https://github.githubassets.com/favicons/favicon-dark.svg
url	https://github.githubassets.com/favicons/favicon-dark.png
url	https://github.githubassets.com/assets/chunk-ref-selector-fdfc13a4.js
url	https://collector.githubapp.com/github-external/browser_event
url	https://github.githubassets.com/assets/chunk-runner-groups-496cb7e9.js
url	https://gist.github.com/join?return_to=https%3A%2F%2Fgist.github.com%2Frichlander%2Fe3c0031e226ee06481668867955b82de
url	https://gist.github.com/opensearch-gist.xml
url	https://github.githubassets.com/assets/chunk-animate-on-scroll-e6d58a4a.js
url	https://github.githubassets.com/
url	https://gist.github.com/
url	https://docs.github.com/articles/which-remote-url-should-i-use

Yara rule detected in process memory (10 events)

description	Communications use DNS	rule	Network_DNS
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 9, 2021, 6:16 p.m.	status_code: 0xffffffff process_identifier: 2940 process_handle: 0x00000354		0	0
NtTerminateProcess July 9, 2021, 6:16 p.m.	status_code: 0xffffffff process_identifier: 2940 process_handle: 0x00000354	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

209.141.34.39

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2940 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c		3221225496	0
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2976 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000358	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\chrom

reg_value

"C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrom.exe"

Harvests credentials from local FTP client softwares (22 events)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\test22\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 manipulating memory of non-child process 2940
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2940 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c		3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2976 process_handle: 0x00000358	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2976 process_handle: 0x00000358	1	1	0

Harvests credentials from local email clients (4 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 called NtSetContextThread to modify thread in remote process 2976
NtSetContextThread July 9, 2021, 6:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000354 process_identifier: 2976	1	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 resumed a thread in remote process 2976
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000354 suspend_count: 1 process_identifier: 2976	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.d34220b859ea98b8
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.450956
Cyren	W32/Jigsaw.A.gen!Eldorado
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win32:CrypterX-gen [Trj]
DrWeb	Trojan.PackedNET.919
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
McAfee	Artemis!D34220B859EA
Malwarebytes	MachineLearning/Anomalous.100%
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.ABUB!tr
BitDefenderTheta	Gen:NN.ZemsilCO.34790.xm0@a4O8hKf
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (W)

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

209.141.34.39:80

Executed a process and injected code into it, probably while unpacking (27 events)

Time & API	Arguments	Status	Return
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000258 suspend_count: 1 process_identifier: 2388	1	0
NtGetContextThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000002e0 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000310 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000328 suspend_count: 1 process_identifier: 2388	1	0
CreateProcessInternalW July 9, 2021, 6:16 p.m.	thread_identifier: 2944 thread_handle: 0x00000268 process_identifier: 2940 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\PL_0260_63_108_117.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000016c	1	1
NtGetContextThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000268	1	0
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2940 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c		3221225496
CreateProcessInternalW July 9, 2021, 6:16 p.m.	thread_identifier: 2980 thread_handle: 0x00000354 process_identifier: 2976 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\PL_0260_63_108_117.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000358	1	1
NtGetContextThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000354	1	0
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2976 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000358	1	0
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: base_address: 0x00401000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: base_address: 0x00415000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: base_address: 0x004a0000 process_identifier: 2976 process_handle: 0x00000358	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2976 process_handle: 0x00000358	1	1
NtSetContextThread July 9, 2021, 6:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000354 process_identifier: 2976	1	0
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000354 suspend_count: 1 process_identifier: 2976	1	0
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2976	1	0

PL_0260_63_108_117.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All