Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 9, 2021, 6:15 p.m.	July 9, 2021, 6:38 p.m.

Size	392.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8e5e70c4ec5752d0f6a082e834e25f51`
SHA256	`8efd1270bebdd589a5f264fe90ac2d2b163b245b7009290c4a4b763504269cdb`
CRC32	`12DC2D53`
ssdeep	`12288:vW8uCJjuCn6iQUB8CHPku8TvKNK6KSKnMR31KTcW+fUrC/iBQ:vW2spxni1K+fUrr`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature

TL_006251_07.exe "C:\Users\test22\AppData\Local\Temp\TL_006251_07.exe"
2400
- TL_006251_07.exe C:\Users\test22\AppData\Local\Temp\TL_006251_07.exe
  2948

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
209.141.34.39	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 9, 2021, 6:17 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 9, 2021, 6:15 p.m.			0	0
IsDebuggerPresent July 9, 2021, 6:15 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 9, 2021, 6:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f5f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f6298 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 9, 2021, 6:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f6298 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 9, 2021, 6:15 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 9, 2021, 6:16 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e 0x634cc35 0x634cbaa 0x634a138 0x63495fb 0x6341394 0x4e90c3f system+0x1d3f63 @ 0x70683f63 0xc2275c 0xc226d1 system+0x1d3155 @ 0x70683155 0xc216f3 system+0x19c522 @ 0x710fc522 system+0x19e920 @ 0x710fe920 system+0x19e803 @ 0x710fe803 0xc2070a system+0x1f9799 @ 0x71159799 system+0x1f92c8 @ 0x711592c8 system+0x1eca74 @ 0x7114ca74 system+0x1ec868 @ 0x7114c868 system+0x1f82b8 @ 0x711582b8 system+0x1ee54d @ 0x7114e54d system+0x1f70ea @ 0x711570ea system+0x1e56c0 @ 0x711456c0 system+0x1f8215 @ 0x71158215 system+0x1f6f75 @ 0x71156f75 system+0x1ee251 @ 0x7114e251 system+0x1ee229 @ 0x7114e229 system+0x1ee170 @ 0x7114e170 0x33a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a system+0x1ebc85 @ 0x7114bc85 system+0x1f683b @ 0x7115683b system+0x1a5e44 @ 0x71105e44 system+0x1fd8a0 @ 0x7115d8a0 system+0x1fd792 @ 0x7115d792 system+0x1a14bd @ 0x711014bd 0xc20084 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x75b5b479 registers.esp: 4580488 registers.edi: 1978982344 registers.eax: 13041664 registers.ebp: 4580692 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 9, 2021, 6:16 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x75b5b37e
0x634cc35
0x634cbaa
0x634a138
0x63495fb
0x6341394
0x4e90c3f
system+0x1d3f63 @ 0x70683f63
0xc2275c
0xc226d1
system+0x1d3155 @ 0x70683155
0xc216f3
system+0x19c522 @ 0x710fc522
system+0x19e920 @ 0x710fe920
system+0x19e803 @ 0x710fe803
0xc2070a
system+0x1f9799 @ 0x71159799
system+0x1f92c8 @ 0x711592c8
system+0x1eca74 @ 0x7114ca74
system+0x1ec868 @ 0x7114c868
system+0x1f82b8 @ 0x711582b8
system+0x1ee54d @ 0x7114e54d
system+0x1f70ea @ 0x711570ea
system+0x1e56c0 @ 0x711456c0
system+0x1f8215 @ 0x71158215
system+0x1f6f75 @ 0x71156f75
system+0x1ee251 @ 0x7114e251
system+0x1ee229 @ 0x7114e229
system+0x1ee170 @ 0x7114e170
0x33a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75dc62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75dc6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75dc6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75dc6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7777011a
system+0x1ebc85 @ 0x7114bc85
system+0x1f683b @ 0x7115683b
system+0x1a5e44 @ 0x71105e44
system+0x1fd8a0 @ 0x7115d8a0
system+0x1fd792 @ 0x7115d792
system+0x1a14bd @ 0x711014bd
0xc20084
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x75b5b479
registers.esp: 4580488
registers.edi: 1978982344
registers.eax: 13041664
registers.ebp: 4580692
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74081000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74082000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00355000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0035b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00357000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00347000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06301000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06302000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06303000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06341000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06342000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06343000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06345000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06347000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:15 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06348000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06349000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0634a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0634b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW July 9, 2021, 6:16 p.m.	number_of_free_clusters: 3063981 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW July 9, 2021, 6:16 p.m.	number_of_free_clusters: 3063981 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Steals private information from local Internet browsers (19 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005d400', u'virtual_address': u'0x00002000', u'entropy': 7.872163523649954, u'name': u'.text', u'virtual_size': u'0x0005d314'}

entropy

7.87216352365

description

A section with a high entropy has been found

entropy

0.952745849298

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 9, 2021, 6:15 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 9, 2021, 6:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 65 events)

url	https://github.githubassets.com/assets/chunk-metric-selection-element-45db9a2c.js
url	https://github.githubassets.com/assets/chunk-invitations-966a2c1b.js
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/archive/7fcc4aed117517be1f7c7ac7dde768ac98a3c266.zip
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/raw/7fcc4aed117517be1f7c7ac7dde768ac98a3c266/modernizing-csharp9.md
url	https://github.githubassets.com/assets/chunk-filter-input-62b45627.js
url	https://github.githubassets.com/assets/chunk-contributions-spider-graph-3f6f54d2.js
url	https://github.githubassets.com/assets/chunk-drag-drop-ea3fe848.js
url	https://github.githubassets.com/assets/chunk-profile-pins-element-99ad0e3b.js
url	https://github.com/
url	https://gist.github.com/discover
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/forks
url	http://www.ibsensoftware.com/
url	https://github.githubassets.com/assets/chunk-codemirror-d0c668af.js
url	https://github-cloud.s3.amazonaws.com/
url	https://github.githubassets.com/assets/chunk-insights-graph-675c1cc8.js
url	https://github.githubassets.com/assets/chunk-three.module-9ca6b751.js
url	https://github.githubassets.com/assets/chunk-user-status-submit-50e14d5b.js
url	https://github.githubassets.com/assets/chunk-severity-calculator-element-b64efa7a.js
url	https://api.github.com/_private/browser/optimizely_client/errors
url	https://github.githubassets.com/assets/chunk-jump-to-e0cc4642.js
url	https://avatars.githubusercontent.com/
url	https://gist.github.com/richlander
url	http://schema.org/Code
url	https://github.githubassets.com/assets/chunk-emoji-picker-element-6a2a8c20.js
url	https://docs.microsoft.com/dotnet/api/system.diagnostics.codeanalysis.notnullwhenattribute
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de.js
url	https://github.githubassets.com/assets/chunk-edit-hook-secret-element-55249df9.js
url	https://desktop.github.com/
url	https://gist.github.com/search
url	https://user-images.githubusercontent.com/
url	https://github.githubassets.com/assets/chunk-tweetsodium-d6f499bf.js
url	https://gist.github.com/richlander.atom
url	https://github.githubassets.com/assets/chunk-readme-toc-element-7663f4a6.js
url	https://github.githubassets.com/assets/chunk-launch-code-element-56d75ac0.js
url	https://gist.github.com/richlander/e3c0031e226ee06481668867955b82de/stargazers
url	https://api.github.com/_private/browser/errors
url	https://github.githubassets.com/assets/chunk-profile-860a1228.js
url	https://gist.github.com/fluidicon.png
url	https://github.githubassets.com/favicons/favicon-dark.svg
url	https://github.githubassets.com/favicons/favicon-dark.png
url	https://github.githubassets.com/assets/chunk-ref-selector-fdfc13a4.js
url	https://collector.githubapp.com/github-external/browser_event
url	https://github.githubassets.com/assets/chunk-runner-groups-496cb7e9.js
url	https://gist.github.com/join?return_to=https%3A%2F%2Fgist.github.com%2Frichlander%2Fe3c0031e226ee06481668867955b82de
url	https://gist.github.com/opensearch-gist.xml
url	https://github.githubassets.com/assets/chunk-animate-on-scroll-e6d58a4a.js
url	https://github.githubassets.com/
url	https://gist.github.com/
url	https://docs.github.com/articles/which-remote-url-should-i-use

Yara rule detected in process memory (10 events)

description	Communications use DNS	rule	Network_DNS
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

209.141.34.39

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2948 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000170	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\chrom

reg_value

"C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrom.exe"

Harvests credentials from local FTP client softwares (22 events)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\test22\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2948 process_handle: 0x00000170	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2948 process_handle: 0x00000170	1	1	0

Harvests credentials from local email clients (4 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2400 called NtSetContextThread to modify thread in remote process 2948
NtSetContextThread July 9, 2021, 6:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000026c process_identifier: 2948	1	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2400 resumed a thread in remote process 2948
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2948	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.8e5e70c4ec5752d0
McAfee	Artemis!8E5E70C4EC57
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.fca674
Cyren	W32/MSIL_Dropper.A.gen!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.ABWK
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win32:CrypterX-gen [Trj]
DrWeb	Trojan.PackedNET.919
McAfee-GW-Edition	Artemis!Trojan
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	MachineLearning/Anomalous.100%
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.ABUB!tr
BitDefenderTheta	Gen:NN.ZemsilF.34790.ym0@aO7dpCm
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (W)

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

209.141.34.39:80

Executed a process and injected code into it, probably while unpacking (24 events)

Time & API	Arguments	Status	Return
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 2400	1	0
NtGetContextThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000002b4 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000318 suspend_count: 1 process_identifier: 2400	1	0
NtResumeThread July 9, 2021, 6:15 p.m.	thread_handle: 0x00000330 suspend_count: 1 process_identifier: 2400	1	0
CreateProcessInternalW July 9, 2021, 6:16 p.m.	thread_identifier: 2952 thread_handle: 0x0000026c process_identifier: 2948 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\TL_006251_07.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000170	1	1
NtGetContextThread July 9, 2021, 6:16 p.m.	thread_handle: 0x0000026c	1	0
NtAllocateVirtualMemory July 9, 2021, 6:16 p.m.	process_identifier: 2948 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000170	1	0
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: base_address: 0x00401000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: base_address: 0x00415000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: base_address: 0x004a0000 process_identifier: 2948 process_handle: 0x00000170	1	1
WriteProcessMemory July 9, 2021, 6:16 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2948 process_handle: 0x00000170	1	1
NtSetContextThread July 9, 2021, 6:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000026c process_identifier: 2948	1	0
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2948	1	0
NtResumeThread July 9, 2021, 6:16 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2948	1	0

TL_006251_07.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All