Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 13, 2021, 9:27 a.m.	July 13, 2021, 9:32 a.m.

Size	2.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`02a19d3dfdcf507f3f7039bb361f08ca`
SHA256	`60b1e21007ef93c3ac0bb8fcb0d063f2429aae47b4715d0324096887aeb165f8`
CRC32	`8EB6BFAF`
ssdeep	`24576:VjVhedI1hLgOCkzFgTMwSjRaqUN1Y8xQ5qKj5RrMqelfhZy8XsuVnraJZkH9mhaO:V7CkzFpvRae8KYvvlf/y8cYrgZRavB`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Malicious_Packer_Zero - Malicious Packer

MetroSoftware.exe "C:\Users\test22\AppData\Local\Temp\MetroSoftware.exe"
2544
- MetroSoftware.exe "{path}"
  2836

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
147.124.207.64	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 13, 2021, 9:27 a.m.			0	0
IsDebuggerPresent July 13, 2021, 9:27 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 13, 2021, 9:27 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74081000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74082000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70ea2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:27 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 9:30 a.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 9:30 a.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742f2000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001fce00', u'virtual_address': u'0x00002000', u'entropy': 7.950960389357079, u'name': u'.text', u'virtual_size': u'0x001fcc94'}

entropy

7.95096038936

description

A section with a high entropy has been found

entropy

0.996816846229

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 13, 2021, 9:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 13, 2021, 9:30 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 13, 2021, 9:30 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: ccf8c354c5ac2e9544bed114c459a7c00e7ec7f2

Communicates with host for which no DNS query was performed (1 event)

host

147.124.207.64

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2836 region_size: 4079616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c4	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 13, 2021, 9:30 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

MetroSoftware.exe tried to sleep 5456640 seconds, actually delayed analysis time by 5456640 seconds

Installs an hook procedure to monitor for mouse events (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW July 13, 2021, 9:30 a.m.	thread_identifier: 0 callback_function: 0x0050f84a hook_identifier: 14 (WH_MOUSE_LL) module_address: 0x00000000	1	262595	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 13, 2021, 9:28 a.m.	buffer: <0>(0>h0>J0>X0>v0>KERNEL32.DLLExitProcessGetProcAddressLoadLibraryAVirtualProtect >2759P9T9X9\9p9´9À9 >2759P9T9X9\9p9´9À9 base_address: 0x007e3000 process_identifier: 2836 process_handle: 0x000002c4	1	1	0
WriteProcessMemory July 13, 2021, 9:28 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2836 process_handle: 0x000002c4	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW July 13, 2021, 9:30 a.m.	thread_identifier: 0 callback_function: 0x004ca8cc hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000	1	328045	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 called NtSetContextThread to modify thread in remote process 2836
NtSetContextThread July 13, 2021, 9:28 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 8267568 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002c0 process_identifier: 2836	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 resumed a thread in remote process 2836
NtResumeThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2836	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

147.124.207.64:1234

Executed a process and injected code into it, probably while unpacking (26 events)

Time & API	Arguments	Status	Return
NtResumeThread July 13, 2021, 9:27 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread July 13, 2021, 9:27 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread July 13, 2021, 9:27 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 2544	1	0
NtGetContextThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2544	1	0
NtGetContextThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2544	1	0
CreateProcessInternalW July 13, 2021, 9:28 a.m.	thread_identifier: 2840 thread_handle: 0x000002c0 process_identifier: 2836 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\MetroSoftware.exe track: 1 command_line: "{path}" filepath_r: C:\Users\test22\AppData\Local\Temp\MetroSoftware.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002c4	1	1
NtGetContextThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000002c0	1	0
NtAllocateVirtualMemory July 13, 2021, 9:28 a.m.	process_identifier: 2836 region_size: 4079616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c4	1	0
WriteProcessMemory July 13, 2021, 9:28 a.m.	buffer: base_address: 0x00400000 process_identifier: 2836 process_handle: 0x000002c4	1	1
WriteProcessMemory July 13, 2021, 9:28 a.m.	buffer: base_address: 0x00672000 process_identifier: 2836 process_handle: 0x000002c4	1	1
WriteProcessMemory July 13, 2021, 9:28 a.m.	buffer: <0>(0>h0>J0>X0>v0>KERNEL32.DLLExitProcessGetProcAddressLoadLibraryAVirtualProtect >2759P9T9X9\9p9´9À9 >2759P9T9X9\9p9´9À9 base_address: 0x007e3000 process_identifier: 2836 process_handle: 0x000002c4	1	1
WriteProcessMemory July 13, 2021, 9:28 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2836 process_handle: 0x000002c4	1	1
NtSetContextThread July 13, 2021, 9:28 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 8267568 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002c0 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:28 a.m.	thread_handle: 0x000002d8 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread July 13, 2021, 9:30 a.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:30 a.m.	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:30 a.m.	thread_handle: 0x000002d4 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:30 a.m.	thread_handle: 0x000002dc suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:30 a.m.	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread July 13, 2021, 9:30 a.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2836	1	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Elastic	malicious (high confidence)
ALYac	Trojan.GenericKDZ.76321
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.84f746
Arcabit	Trojan.Generic.D12A21
Cyren	W32/MSIL_Kryptik.ESE.gen!Eldorado
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/Kryptik.ABVM
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
BitDefender	Trojan.GenericKDZ.76321
MicroWorld-eScan	Trojan.GenericKDZ.76321
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.GenericKDZ.76321
Sophos	ML/PE-A
DrWeb	Trojan.DownLoader40.32316
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
MaxSecure	Trojan.Malware.300983.susgen
FireEye	Generic.mg.02a19d3dfdcf507f
Emsisoft	Trojan.GenericKDZ.76321 (B)
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/AgentTesla!ml
GData	Trojan.GenericKDZ.76321
AhnLab-V3	Trojan/Win.Generic.C4545210
McAfee	AgentTesla-FDAH!02A19D3DFDCF
Malwarebytes	MachineLearning/Anomalous.100%
Yandex	Trojan.AvsArher.bSIdr7
Ikarus	Trojan.MSIL.Inject
eGambit	Unsafe.AI_Score_72%
Fortinet	MSIL/Basic.gen!tr
BitDefenderTheta	Gen:NN.ZemsilF.34790.@n0@a4I6ubh
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM03.0.884B.Malware.Gen

MetroSoftware.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All