Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 28, 2021, 1:34 p.m.	July 28, 2021, 1:37 p.m.

Size	1.4MB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`2277d429c84ae278bb725fbc849f7c27`
SHA256	`f301d30aa969aaf944fa353262020c9c9533c8e9f1b0476f35b698aeaf684434`
CRC32	`AC41912A`
ssdeep	`24576:nwTvvDeEejmrC31rsr8XO64qrqfs6/DH07NDxfgM0g1YcsU4HBf7+MRhlNVzxdtb:dEIhDjfr07uRxfn08YcstHBfnj`
PDB Path	document.pdb
Yara	IsPE32 - (no description) Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

IAF Attack Jammu.exe "C:\Users\test22\AppData\Local\Temp\IAF Attack Jammu.exe"
1116
- chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "C:\Users\test22\AppData\Roaming\IAF attack.pdf"
  1396
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef3c2f1e8,0x7fef3c2f1f8,0x7fef3c2f208
    1048
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2744 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
    1892
- svchost.exe "C:\Users\test22\AppData\Local\Postman\svchost.exe"
  2724

Name	Response	Post-Analysis Lookup
nicindia.mywire.org
emailgov-in.sytes.net	A 122.252.225.26	122.252.225.26

IP Address	Status	Action
122.252.225.26	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 28, 2021, 1:35 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 28, 2021, 1:35 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (41 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2021, 1:34 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:34 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:28 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:35 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:35 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:27 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

document.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe\PATH

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 28, 2021, 1:34 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 28, 2021, 1:28 p.m.	stacktrace: 0x5a2e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 e4 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a2e04 registers.r14: 178973120 registers.r15: 178973560 registers.rcx: 1532 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 108185120 registers.rsp: 178972296 registers.r11: 178976816 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 1556 registers.r12: 32553152 registers.rbp: 178972432 registers.rdi: 32292992 registers.rax: 5910016 registers.r13: 178972992	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

emailgov-in.sytes.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 51 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00791000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00306000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:34 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 1116 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00794000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 1116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00798000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:27 p.m.	process_identifier: 1396 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72531000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72532000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eeb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:35 p.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:27 p.m.	process_identifier: 1048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

svchost.exe tried to sleep 125 seconds, actually delayed analysis time by 125 seconds

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 1396 crashed
__exception__ July 28, 2021, 1:28 p.m.	stacktrace: 0x5a2e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 e4 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x5a2e04 registers.r14: 178973120 registers.r15: 178973560 registers.rcx: 1532 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 108185120 registers.rsp: 178972296 registers.r11: 178976816 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 1556 registers.r12: 32553152 registers.rbp: 178972432 registers.rdi: 32292992 registers.rax: 5910016 registers.r13: 178972992	1	0	0

Steals private information from local Internet browsers (43 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing IP Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Stability\1396-1627446904421875.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List Prefix Set
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Module Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Side-Effect Free Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Inclusion Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Csd Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\b66ec25d-2e4b-436c-9642-32e2e0e27b2f.dmp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Managed Mode Settings
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Extension Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Resource Blacklist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Policy\User Policy
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download Whitelist
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\AnyIpMalware.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-610161BE-574.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F2CDF32-998.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\IAF attack.pdf

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Postman\svchost.exe

Creates a suspicious process (2 events)

cmdline	C:\Users\test22\AppData\Local\Postman\svchost.exe
cmdline	"C:\Users\test22\AppData\Local\Postman\svchost.exe"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Roaming\IAF attack.pdf
file	C:\Users\test22\AppData\Local\Postman\svchost.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Postman\svchost.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 28, 2021, 1:35 p.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00165600', u'virtual_address': u'0x00002000', u'entropy': 7.977849162766187, u'name': u'.text', u'virtual_size': u'0x001654e4'}

entropy

7.97784916277

description

A section with a high entropy has been found

entropy

0.99651446497

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (50 out of 1141 events)

url	https://clients4.google.com/invalidation/android/request/
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url	http://services.ukrposhta.com/postindex_new/
url	http://dts.search-results.com/sr?lng=
url	http://inposdom.gob.do/codigo-postal/
url	http://creativecommons.org/ns
url	http://www.postur.fo/
url	https://qc.search.yahoo.com/search?ei=
url	https://cacert.omniroot.com/baltimoreroot.crt09
url	https://codereview.chromium.org/25305002).
url	https://search.yahoo.com/search?ei=
url	http://t1.symcb.com/ThawtePCA.crl0/
url	http://crbug.com/31395.
url	https://support.google.com/chrome/answer/165139
url	http://crbug.com/320723
url	https://datasaver.googleapis.com/v1/clientConfigs
url	http://crl.starfieldtech.com/sfroot-g2.crl0L
url	https://ct.startssl.com/
url	https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url	https://de.search.yahoo.com/favicon.ico
url	https://github.com/GoogleChrome/Lighthouse/issues
url	http://www.searchnu.com/favicon.ico
url	https://support.google.com/installer/?product=
url	http://msdn.microsoft.com/en-us/library/ms792901.aspx
url	https://www.najdi.si/search.jsp?q=
url	http://x.ss2.us/x.cer0
url	http://crl.geotrust.com/crls/gtglobal.crl04
url	https://accounts.google.com/ServiceLogin
url	https://accounts.google.com/OAuthLogin
url	https://c.android.clients.google.com/
url	https://search.goo.ne.jp/sgt.jsp?MT=
url	https://www.google.com/tools/feedback/chrome/__submit
url	https://chrome.google.com/webstore/category/collection/dark_themes
url	http://check.googlezip.net/generate_204
url	http://ocsp.starfieldtech.com/08
url	http://www.guernseypost.com/postcode_finder/
url	http://crl.certum.pl/ca.crl0h
url	http://ator
url	https://suggest.yandex.by/suggest-ff.cgi?part=
url	http://feed.snap.do/?q=
url	https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url	http://www.language
url	https://support.google.com/chrome/
url	http://developer.chrome.com/apps/declare_permissions.html
url	http://www.google.com/chrome/intl/ko/eula_text.html
url	https://www.globalsign.com/repository/03
url	http://www.startssl.com/sfsca.crl0
url	http://UA-Compatible
url	https://se.search.yahoo.com/search?ei=
url	http://EVSecure-ocsp.geotrust.com0

Yara rule detected in process memory (50 out of 1369 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Perform crypto currency mining	rule	BitCoin
description	Record Audio	rule	Sniff_Audio
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Virtual currency	rule	Virtual_currency_Zero
description	Run a KeyLogger	rule	KeyLogger
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	browser info stealer	rule	infoStealer_browser_Zero
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Perform crypto currency mining	rule	BitCoin
description	Record Audio	rule	Sniff_Audio
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Virtual currency	rule	Virtual_currency_Zero
description	Run a KeyLogger	rule	KeyLogger
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP

Created a process named as a common system process (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 28, 2021, 1:35 p.m.	thread_identifier: 1296 thread_handle: 0x000003ec process_identifier: 2724 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Postman\svchost.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Postman\svchost.exe" filepath_r: C:\Users\test22\AppData\Local\Postman\svchost.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003f4	1	1	0
ShellExecuteExW July 28, 2021, 1:35 p.m.	show_type: 1 filepath_r: C:\Users\test22\AppData\Local\Postman\svchost.exe parameters: filepath: C:\Users\test22\AppData\Local\Postman\svchost.exe	1	1	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 28, 2021, 1:29 p.m.	status_code: 0xc0000005 process_identifier: 1396 process_handle: 0x0000000000000094		0	0
NtTerminateProcess July 28, 2021, 1:29 p.m.	status_code: 0xc0000005 process_identifier: 1396 process_handle: 0x0000000000000094	1	0	0

One or more non-whitelisted processes were created (3 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1168,2800434343238983625,5251151139285541740,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=E64C5C305FB701546789472376FE3668 --mojo-platform-channel-handle=1192 --ignored=" --type=renderer " /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2744 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef3c2f1e8,0x7fef3c2f1f8,0x7fef3c2f208

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

Resumed a suspended thread in a remote process potentially indicative of process injection (38 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1048 resumed a thread in remote process 1396
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0
NtResumeThread July 28, 2021, 1:28 p.m.	thread_handle: 0x0000000000000150 suspend_count: 2 process_identifier: 1396	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

122.252.225.26:9512

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Riskware
ALYac	Trojan.MSIL.Crypt.gen
Malwarebytes	Malware.AI.1844343923
Zillya	Trojan.Crypt.Win32.71914
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Generic.9767daab
K7GW	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D237062C
Cyren	W32/Trojan.KHKN-8689
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/TrojanDropper.Agent.FGL
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.37160492
MicroWorld-eScan	Trojan.GenericKD.37160492
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.37160492
Sophos	Generic ML PUA (PUA)
TrendMicro	TROJ_GEN.R002C0WG121
McAfee-GW-Edition	BehavesLike.Win32.Trojan.tc
FireEye	Generic.mg.2277d429c84ae278
Emsisoft	Trojan.GenericKD.37160492 (B)
Ikarus	Trojan.Dropper
Jiangmin	Trojan.MSIL.aczrw
Avira	TR/Dropper.MSIL.Gen
eGambit	Unsafe.AI_Score_64%
Microsoft	Trojan:Win32/Tiggre!rfn
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.37160492
McAfee	Artemis!2277D429C84A
MAX	malware (ai score=82)
VBA32	TScope.Trojan.MSIL
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0WG121
Yandex	Trojan.Crypt!kgNjvmEO9/Y
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Crypt!tr
BitDefenderTheta	Gen:NN.ZemsilF.34050.zr0@aatFuwf
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/TrojanDropper.Generic.HgIASXcA

IAF Attack Jammu.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All