Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 21, 2021, 10:10 a.m.	July 21, 2021, 10:13 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ff361121c102c043c2c4b5c6a6b4410c`
SHA256	`94103dbd5eb93afbe5f2cd2b500d3150d7f62663c8566f19e3f5ab3883faad09`
CRC32	`1E4ECCD9`
ssdeep	`24576:T5uYds5XAVoAN5wiNRgEKqXjkAR/WnljbIcFTf91vM9LkiOTErbirscQuWG:T5dmAVoU5l8Zqwe0Ffok0cz9H`
Yara	IsPE32 - (no description) Generic_Malware_Zero - Generic Malware Lazarus_Zero - Lazarus Generic Malware Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library themida_packer - themida packer PE_Header_Zero - PE File Signature

redik.exe "C:\Users\test22\AppData\Local\Temp\redik.exe"
112

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.226.139.106	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 21, 2021, 10:10 a.m.			0	0
IsDebuggerPresent July 21, 2021, 10:10 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 21, 2021, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b6e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2021, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b6e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 21, 2021, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b6eb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 21, 2021, 10:10 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 21, 2021, 10:10 a.m.	stacktrace: redik+0x3e1ab7 @ 0xe31ab7 redik+0x3e1b54 @ 0xe31b54 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 19 ed 24 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3538384 registers.edi: 12566528 registers.eax: 3538384 registers.ebp: 3538464 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2000778283 registers.ecx: 4036034560	1
__exception__ July 21, 2021, 10:10 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 7d 7b e8 ff exception.symbol: redik+0x3f3da7 exception.instruction: in eax, dx exception.module: redik.exe exception.exception_code: 0xc0000096 exception.offset: 4144551 exception.address: 0xe43da7 registers.esp: 3538504 registers.edi: 13435824 registers.eax: 1750617430 registers.ebp: 12566528 registers.edx: 940118 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ July 21, 2021, 10:10 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: redik+0x3f3e1b exception.instruction: in eax, dx exception.module: redik.exe exception.exception_code: 0xc0000096 exception.offset: 4144667 exception.address: 0xe43e1b registers.esp: 3538504 registers.edi: 13435824 registers.eax: 1447909480 registers.ebp: 12566528 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 122 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a84000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757af000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2021, 10:10 a.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575d000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

redik.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 21, 2021, 10:10 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00012e00', u'virtual_address': u'0x00002000', u'entropy': 7.994207134829014, u'name': u' ', u'virtual_size': u'0x00032000'}

entropy

7.99420713483

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000fc00', u'virtual_address': u'0x00034000', u'entropy': 7.997123163661484, u'name': u' ', u'virtual_size': u'0x0016834c'}

entropy

7.99712316366

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0011d400', u'virtual_address': u'0x00468000', u'entropy': 7.911087649388727, u'name': u'.boot', u'virtual_size': u'0x0011d400'}

entropy

7.91108764939

description

A section with a high entropy has been found

entropy

0.971895176605

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

194.226.139.106

Checks for the presence of known windows from debuggers and forensic tools (50 out of 159 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 21, 2021, 10:10 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:10 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA July 21, 2021, 10:11 a.m.	class_name: Filemonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 21, 2021, 10:10 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 21, 2021, 10:10 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: redik+0x3f3e1b exception.instruction: in eax, dx exception.module: redik.exe exception.exception_code: 0xc0000096 exception.offset: 4144667 exception.address: 0xe43e1b registers.esp: 3538504 registers.edi: 13435824 registers.eax: 1447909480 registers.ebp: 12566528 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.MSIL.Reline.i!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46634715
CAT-QuickHeal	Trojan.Agent
ALYac	Trojan.GenericKD.46634715
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.2326736
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanPSW:MSIL/Reline.32dff6e1
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/Trojan.RAYV-0070
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/Spy.Agent.DFY
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-PSW.MSIL.Reline.dli
BitDefender	Trojan.GenericKD.46634715
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:DangerousSig [Trj]
Rising	Trojan.Generic@ML.100 (RDMK:MvJXs4k8XtKwaRXtQsqRrQ)
Ad-Aware	Trojan.GenericKD.46634715
DrWeb	Trojan.PWS.Siggen3.956
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R049C0WGC21
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.ff361121c102c043
Emsisoft	Trojan.GenericKD.46634715 (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Spy.Agent.ojeqx
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=88)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:MSIL/RedLineStealer!MSR
Gridinsoft	Trojan.Win32.Agent.oa
Arcabit	Trojan.Generic.D2C796DB
GData	Trojan.GenericKD.46634715
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R429793
McAfee	Artemis!FF361121C102
VBA32	BScope.TrojanPSW.Agent
Malwarebytes	Trojan.MalPack.Themida
TrendMicro-HouseCall	TROJ_GEN.R049C0WGC21
Tencent	Win32.Trojan.Falsesign.Efas
Yandex	Trojan.PWS.Reline!YZf6FzbuWTU
Ikarus	Trojan.Win32.Generic
MaxSecure	Trojan.Malware.300983.susgen

redik.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All