Summary | ZeroBOX

Order List.gz.exe

Generic Malware email stealer Admin Tool (Sysinternals etc ...) Antivirus ScreenShot DNS Steal credential AntiDebug PE32 PE File .NET EXE AntiVM
Category Machine Started Completed
FILE s1_win7_x6403_us July 29, 2021, 9:38 a.m. July 29, 2021, 9:40 a.m.
Size 697.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e0f6bbc12ebe2102cf3fcf74f9d690d9
SHA256 35d212409544435a45ce577615da11f75cc4cf6dc56bce849651aede5c1ae437
CRC32 C6A1A554
ssdeep 12288:ETy8p17iS/d348K13c//sqQonbTWPsUwmxEHr9b8GcH3uExo4Kiazs:EPpMS/d34S//LQonbTAsUwmWrV8GcHJe
Yara
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
79.134.225.100 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 79.134.225.100:1985 2025019 ET MALWARE Possible NanoCore C2 60B Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function
console_handle: 0x00000023
1 1 0

WriteConsoleW

buffer: , script file, or operable program. Check the spelling of the name, or if a pat
console_handle: 0x0000002f
1 1 0

WriteConsoleW

buffer: h was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

buffer: At line:1 char:17
console_handle: 0x00000047
1 1 0

WriteConsoleW

buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\Orde
console_handle: 0x00000053
1 1 0

WriteConsoleW

buffer: r List.gz.exe
console_handle: 0x0000005f
1 1 0

WriteConsoleW

buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle: 0x0000006b
1 1 0

WriteConsoleW

buffer: mmandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b1188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b1288
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b1288
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8c58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8c58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8c58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8f98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8f98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8f98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8f98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8f98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8f98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8c58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8c58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8c58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b89d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x003b8818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 552
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73df1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73df2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00580000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00537000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00536000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b05000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b06000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b07000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b08000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05050000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05051000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05056000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05057000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05058000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05059000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fbd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0227a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fbd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02272000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0246a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0247b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Login Data
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Order List.gz.exe"
cmdline powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Order List.gz.exe"
Time & API Arguments Status Return Repeated

ShellExecuteExW

show_type: 0
filepath_r: powershell
parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Order List.gz.exe"
filepath: powershell
1 1 0
section {u'size_of_data': u'0x000a8a00', u'virtual_address': u'0x00002000', u'entropy': 7.415150022279126, u'name': u'.text', u'virtual_size': u'0x000a88ec'} entropy 7.41515002228 description A section with a high entropy has been found
entropy 0.967718794835 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.nirsoft.net/
description Take ScreenShot rule ScreenShot
description Steal credential rule local_credential_Steal
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description email clients info stealer rule infoStealer_emailClients_Zero
description Take ScreenShot rule ScreenShot
description Steal credential rule local_credential_Steal
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
buffer Buffer with sha1: 9420a2004c14c4a5e31290936a07bd58dcaa15b3
buffer Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9
buffer Buffer with sha1: 4380fb6de89a7776d52214359ce213d24a2239ad
buffer Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer Buffer with sha1: c1ef2ca62189121934d1a7944ef1bdc1aa319877
buffer Buffer with sha1: 063fb8b27c0872c54bff35e2b76d8f522e13f8b4
buffer Buffer with sha1: 925c5236c59dd8f3efea4b3e091ef735b405a880
buffer Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer Buffer with sha1: dcdec0ea839844e977c1151d2eeedbb0788a34b1
buffer Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: efa4948abb218e47d809bedd1aff08cfb76d40e1
buffer Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
host 79.134.225.100
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 1936
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
1 0 0

NtAllocateVirtualMemory

process_identifier: 680
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000044c
1 0 0

NtAllocateVirtualMemory

process_identifier: 672
region_size: 339968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003c0
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description RegSvcs.exe tried to sleep 3775777962 seconds, actually delayed analysis time by 3775777962 seconds
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host reg_value C:\Program Files (x86)\SMTP Host\smtphost.exe
registry HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW ˜]  H.text˜Ç È `.reloc Ê@B.rsrc˜] ^Ì@@
base_address: 0x00400000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer: à ”7
base_address: 0x00420000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer: @
base_address: 0x7efde008
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ՆŽž‘çà͑çà͑çàÍRè½ÍƒçàÍkĠ͒çàÍKÄü͚çà͑çá͛æàÍkÄù͒çàͶ!’Í·çàͶ!œÍçàͶ!˜ÍçàÍRich‘çàÍPELÃÞRQà  tT @°“®”E܀”/À# ”.text„   `.rdatað7 8@@.datat` F@À.rsrc”/€0R@@
base_address: 0x00400000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzdf$Af$Aÿÿðÿððððÿ €€€€€ € € €€ € €€€€€€€ €€  €€€€ €€  €€ €€€€ € € € €€€€€€€€€ €€ € €€ €€€ €  €€ € €€€ €€ € €€€ €  €€ €€€ € € €€€€ € €€€ € €€ €€ € € €€€€ € € €€ €€€ €  € € € € €€ € € €€€ € €B@@@BB@@@@BBB@BBB@B@@B@BBBB@B@@@ @ @@@ @ @@ @@ @@@ @@ @@@ @@@@ @ @ @@@@ @@@@@ @ @ @@@@ @@ @@ @ @@ @@@ @@@@ @ @@ @@@@@ @@ @@                             @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@néxênëxìdñdòPínîxï xð xó xô Põÿÿðÿððððÿabe2869f-9b47-4cd9-a358-c22904dba7f7ÿÿÿk82BD0E67-9FEA-4748-8672-D5EFE5B779B0
base_address: 0x00416000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer: @
base_address: 0xfffde008
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ít)©dz©dz©dzjkEz«dzjkGz¿dzSGZz¢dzsGz¢dz©dzàezSGzªdzŽ¢hz›dzŽ¢fz¨dzŽ¢bz¨dzRich©dzPEL?ƒRà Ô(&0@0è†tÍð ¼ö`p40D.textÍ `.rdata´0¶"@@.data-ðØ@À.rsrc¼ î@@
base_address: 0x00400000
process_identifier: 672
process_handle: 0x000003c0
1 1 0

WriteProcessMemory

buffer: €`€ x€#€&¨€'À€?؀Rð€   ( 8 H X hx!4ä¬#8ää$Xä<%èä$&tä˜&ºäT'hä %d Passwords , %d SelectedCreated by usingSelect a filename to saveWeb Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat) Loading... %d Text FileTab Delimited Text FileTabular Text FileHTML File - HorizontalHTML File - VerticalXML FileComma Delimited Text FileKeePass csv fileOpera Password File All FilesInternet Explorer 4.0 - 6.0Internet Explorer 7.0 - 9.0 Firefox 1.x Firefox 2.x Firefox 3.0FirefoxChromeOperaSafariInternet Explorer 10.0 SeaMonkeyURL Web Browser User NamePasswordPassword StrengthUser Name FieldPassword Field Very WeakWeakMediumStrong Very Strong
base_address: 0x00452000
process_identifier: 672
process_handle: 0x000003c0
1 1 0

WriteProcessMemory

buffer: @
base_address: 0xfffde008
process_identifier: 672
process_handle: 0x000003c0
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW ˜]  H.text˜Ç È `.reloc Ê@B.rsrc˜] ^Ì@@
base_address: 0x00400000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ՆŽž‘çà͑çà͑çàÍRè½ÍƒçàÍkĠ͒çàÍKÄü͚çà͑çá͛æàÍkÄù͒çàͶ!’Í·çàͶ!œÍçàͶ!˜ÍçàÍRich‘çàÍPELÃÞRQà  tT @°“®”E܀”/À# ”.text„   `.rdatað7 8@@.datat` F@À.rsrc”/€0R@@
base_address: 0x00400000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ít)©dz©dz©dzjkEz«dzjkGz¿dzSGZz¢dzsGz¢dz©dzàezSGzªdzŽ¢hz›dzŽ¢fz¨dzŽ¢bz¨dzRich©dzPEL?ƒRà Ô(&0@0è†tÍð ¼ö`p40D.textÍ `.rdata´0¶"@@.data-ðØ@À.rsrc¼ î@@
base_address: 0x00400000
process_identifier: 672
process_handle: 0x000003c0
1 1 0
registry HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\POP3 User
registry HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Process injection Process 552 called NtSetContextThread to modify thread in remote process 1936
Process injection Process 1936 called NtSetContextThread to modify thread in remote process 680
Process injection Process 1936 called NtSetContextThread to modify thread in remote process 672
Time & API Arguments Status Return Repeated

NtSetContextThread

registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 1936
1 0 0

NtSetContextThread

registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4265556
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000448
process_identifier: 680
1 0 0

NtSetContextThread

registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4466216
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000344
process_identifier: 672
1 0 0
file C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:Zone.Identifier
Process injection Process 552 resumed a thread in remote process 1936
Process injection Process 1936 resumed a thread in remote process 680
Process injection Process 1936 resumed a thread in remote process 672
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x00000448
suspend_count: 1
process_identifier: 680
1 0 0

NtResumeThread

thread_handle: 0x00000344
suspend_count: 1
process_identifier: 672
1 0 0
Lionic Trojan.MSIL.NanoBot.m!c
Elastic malicious (high confidence)
FireEye Generic.mg.e0f6bbc12ebe2102
McAfee Artemis!E0F6BBC12EBE
Cylance Unsafe
Cybereason malicious.c0fcb1
Cyren W32/MSIL_Kryptik.DLO.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/GenKryptik.FIBT
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:Backdoor.MSIL.NanoBot.gen
Avast Win32:PWSX-gen [Trj]
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Ikarus Trojan.Inject
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Trojan:Win32/AgentTesla!ml
GData MSIL.Backdoor.Nancat.L2BT1U
Cynet Malicious (score: 100)
TrendMicro-HouseCall TROJ_GEN.F0D1C00GS21
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.GIQ!tr
AVG Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_90% (W)
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 552
1 0 0

NtResumeThread

thread_handle: 0x00000150
suspend_count: 1
process_identifier: 552
1 0 0

NtResumeThread

thread_handle: 0x00000194
suspend_count: 1
process_identifier: 552
1 0 0

NtResumeThread

thread_handle: 0x00000238
suspend_count: 1
process_identifier: 552
1 0 0

NtGetContextThread

thread_handle: 0x000000e0
1 0 0

NtResumeThread

thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 552
1 0 0

NtResumeThread

thread_handle: 0x00000248
suspend_count: 1
process_identifier: 552
1 0 0

CreateProcessInternalW

thread_identifier: 2208
thread_handle: 0x0000038c
process_identifier: 2200
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\Order List.gz.exe"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003ac
1 1 0

CreateProcessInternalW

thread_identifier: 1156
thread_handle: 0x0000026c
process_identifier: 1936
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000274
1 1 0

NtGetContextThread

thread_handle: 0x0000026c
1 0 0

NtAllocateVirtualMemory

process_identifier: 1936
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
1 0 0

WriteProcessMemory

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW ˜]  H.text˜Ç È `.reloc Ê@B.rsrc˜] ^Ì@@
base_address: 0x00400000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer:
base_address: 0x00402000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer: à ”7
base_address: 0x00420000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer:
base_address: 0x00422000
process_identifier: 1936
process_handle: 0x00000274
1 1 0

WriteProcessMemory

buffer: @
base_address: 0x7efde008
process_identifier: 1936
process_handle: 0x00000274
1 1 0

NtSetContextThread

registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x00000358
suspend_count: 1
process_identifier: 552
1 0 0

NtResumeThread

thread_handle: 0x0000029c
suspend_count: 1
process_identifier: 2200
1 0 0

NtResumeThread

thread_handle: 0x000002f0
suspend_count: 1
process_identifier: 2200
1 0 0

NtResumeThread

thread_handle: 0x0000043c
suspend_count: 1
process_identifier: 2200
1 0 0

NtResumeThread

thread_handle: 0x0000049c
suspend_count: 1
process_identifier: 2200
1 0 0

NtResumeThread

thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x000002e8
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x0000030c
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x0000035c
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x00000370
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x00000388
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x000003bc
suspend_count: 1
process_identifier: 1936
1 0 0

NtResumeThread

thread_handle: 0x00000334
suspend_count: 1
process_identifier: 1936
1 0 0

NtGetContextThread

thread_handle: 0x0000035c
1 0 0

NtGetContextThread

thread_handle: 0x0000035c
1 0 0

NtResumeThread

thread_handle: 0x0000035c
suspend_count: 1
process_identifier: 1936
1 0 0

CreateProcessInternalW

thread_identifier: 1496
thread_handle: 0x00000448
process_identifier: 680
current_directory:
filepath: c:\Windows\microsoft.net\framework\v4.0.30319\vbc.exe
track: 1
command_line: "c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe" /shtml "C:\Users\test22\AppData\Local\Temp\jmwpptvg.mqw"
filepath_r: c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000044c
1 1 0

NtGetContextThread

thread_handle: 0x00000448
1 0 0

NtAllocateVirtualMemory

process_identifier: 680
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000044c
1 0 0

WriteProcessMemory

buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ՆŽž‘çà͑çà͑çàÍRè½ÍƒçàÍkĠ͒çàÍKÄü͚çà͑çá͛æàÍkÄù͒çàͶ!’Í·çàͶ!œÍçàͶ!˜ÍçàÍRich‘çàÍPELÃÞRQà  tT @°“®”E܀”/À# ”.text„   `.rdatað7 8@@.datat` F@À.rsrc”/€0R@@
base_address: 0x00400000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer:
base_address: 0x00401000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer:
base_address: 0x00412000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzdf$Af$Aÿÿðÿððððÿ €€€€€ € € €€ € €€€€€€€ €€  €€€€ €€  €€ €€€€ € € € €€€€€€€€€ €€ € €€ €€€ €  €€ € €€€ €€ € €€€ €  €€ €€€ € € €€€€ € €€€ € €€ €€ € € €€€€ € € €€ €€€ €  € € € € €€ € € €€€ € €B@@@BB@@@@BBB@BBB@B@@B@BBBB@B@@@ @ @@@ @ @@ @@ @@@ @@ @@@ @@@@ @ @ @@@@ @@@@@ @ @ @@@@ @@ @@ @ @@ @@@ @@@@ @ @@ @@@@@ @@ @@                             @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@néxênëxìdñdòPínîxï xð xó xô Põÿÿðÿððððÿabe2869f-9b47-4cd9-a358-c22904dba7f7ÿÿÿk82BD0E67-9FEA-4748-8672-D5EFE5B779B0
base_address: 0x00416000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer:
base_address: 0x00418000
process_identifier: 680
process_handle: 0x0000044c
1 1 0

WriteProcessMemory

buffer: @
base_address: 0xfffde008
process_identifier: 680
process_handle: 0x0000044c
1 1 0

NtSetContextThread

registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4265556
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000448
process_identifier: 680
1 0 0

NtResumeThread

thread_handle: 0x00000448
suspend_count: 1
process_identifier: 680
1 0 0

CreateProcessInternalW

thread_identifier: 2960
thread_handle: 0x00000344
process_identifier: 672
current_directory:
filepath: c:\Windows\microsoft.net\framework\v4.0.30319\vbc.exe
track: 1
command_line: "c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe" /shtml "C:\Users\test22\AppData\Local\Temp\jfyqnkgr.0mn"
filepath_r: c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000003c0
1 1 0

NtGetContextThread

thread_handle: 0x00000344
1 0 0