Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 31, 2021, 1:24 p.m.	July 31, 2021, 1:26 p.m.

Size	924.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`932cb9ca236e1e8c6740d9db01410778`
SHA256	`1a4284cd084b609aa03892894e379c630505b5e4b9ccfc278138d36668f4526f`
CRC32	`1653ADD6`
ssdeep	`24576:sBB4MROxnFE3WO3XrrcI0AilFEvxHPbooR:sQMiuDXrrcI0AilFEvxHP`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Malicious_Packer_Zero - Malicious Packer OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) OS_Name_Check_Zero - OS Name Check Signature UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Win_Backdoor_njRAT_Zero - Win Backdoor njRAT Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

huh.exe "C:\Users\test22\AppData\Local\Temp\huh.exe"
1856
- WindowsInput.exe "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2144
- Orcus.exe "C:\Program Files (x86)\Orcus\Orcus.exe"
  2532
  - OrcusWatchdog.exe "C:\Users\test22\AppData\Local\Temp\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2532
    2724
    - OrcusWatchdog.exe "C:\Users\test22\AppData\Local\Temp\OrcusWatchdog.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 2532
      2788

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 31, 2021, 1:24 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:24 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:24 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (10 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:17 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:17 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:24 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 1137 events)

Time & API	Arguments	Status	Return
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522bc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522bc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522bc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 31, 2021, 1:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00522a88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 31, 2021, 1:24 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 31, 2021, 1:17 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4da49d sxsJitStartup+0x202d0 clrjit+0xc1840 @ 0x7fef0f21840 sxsJitStartup+0x41f6f clrjit+0xe34df @ 0x7fef0f434df sxsJitStartup+0x412a7 clrjit+0xe2817 @ 0x7fef0f42817 getJit-0x7ff7b clrjit+0x21265 @ 0x7fef0e81265 getJit-0x86719 clrjit+0x1aac7 @ 0x7fef0e7aac7 getJit-0x81eca clrjit+0x1f316 @ 0x7fef0e7f316 getJit-0x8057b clrjit+0x20c65 @ 0x7fef0e80c65 getJit-0x805da clrjit+0x20c06 @ 0x7fef0e80c06 getJit-0x9b4b9 clrjit+0x5d27 @ 0x7fef0e65d27 getJit-0x89eb5 clrjit+0x1732b @ 0x7fef0e7732b PreBindAssemblyEx+0x1d9fa CreateHistoryReader-0x5526a clr+0x1207ee @ 0x7fef26407ee PreBindAssemblyEx+0x1d94b CreateHistoryReader-0x55319 clr+0x12073f @ 0x7fef264073f PreBindAssemblyEx+0x1d83a CreateHistoryReader-0x5542a clr+0x12062e @ 0x7fef264062e PreBindAssemblyEx+0x1d718 CreateHistoryReader-0x5554c clr+0x12050c @ 0x7fef264050c PreBindAssemblyEx+0x22162 CreateHistoryReader-0x50b02 clr+0x124f56 @ 0x7fef2644f56 DestroyAssemblyConfigCookie+0xb676 PreBindAssembly-0x161da clr+0xecbfa @ 0x7fef260cbfa PreBindAssemblyEx+0x225b5 CreateHistoryReader-0x506af clr+0x1253a9 @ 0x7fef26453a9 PreBindAssemblyEx+0x1d6bd CreateHistoryReader-0x555a7 clr+0x1204b1 @ 0x7fef26404b1 StrongNameTokenFromPublicKey+0x893a SetRuntimeInfo-0x33006 clr+0x9e88a @ 0x7fef25be88a CoUninitializeEE+0x4d7cd GetMetaDataInternalInterface-0x29f4f clr+0x50971 @ 0x7fef2570971 CoUninitializeEE+0x4cd27 GetMetaDataInternalInterface-0x2a9f5 clr+0x4fecb @ 0x7fef256fecb DllRegisterServerInternal-0xcc6 clr+0x24da @ 0x7fef25224da system+0x9425c @ 0x7feee8d425c system+0x203d4e @ 0x7feeea43d4e system+0x2038cd @ 0x7feeea438cd system+0x1ff53c @ 0x7feeea3f53c system+0x9a0a4 @ 0x7feee8da0a4 system+0x1ff5df @ 0x7feeea3f5df system+0x1f4e4 @ 0x7fef30df4e4 system+0x1d1f6 @ 0x7fef30dd1f6 system+0x2272d @ 0x7fef30e272d system+0x2224e @ 0x7fef30e224e 0x7fe92ea0144 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef256f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef256f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef256f30b _CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef270721c _CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef2707976 _CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef2707870 _CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef27073e6 _CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef270733e _CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef2703ed4 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef33474e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef33e5b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7689652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76fac521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0xe0640002 exception.offset: 42141 exception.address: 0x7fefd4da49d registers.r14: 0 registers.r15: 0 registers.rcx: 38227752 registers.rsi: 0 registers.r10: 8789968243232 registers.rbx: 0 registers.rsp: 1964352 registers.r11: 1949440 registers.r8: 0 registers.r9: 0 registers.rdx: 38231304 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1998014141 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 31, 2021, 1:17 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4da49d
sxsJitStartup+0x202d0 clrjit+0xc1840 @ 0x7fef0f21840
sxsJitStartup+0x41f6f clrjit+0xe34df @ 0x7fef0f434df
sxsJitStartup+0x412a7 clrjit+0xe2817 @ 0x7fef0f42817
getJit-0x7ff7b clrjit+0x21265 @ 0x7fef0e81265
getJit-0x86719 clrjit+0x1aac7 @ 0x7fef0e7aac7
getJit-0x81eca clrjit+0x1f316 @ 0x7fef0e7f316
getJit-0x8057b clrjit+0x20c65 @ 0x7fef0e80c65
getJit-0x805da clrjit+0x20c06 @ 0x7fef0e80c06
getJit-0x9b4b9 clrjit+0x5d27 @ 0x7fef0e65d27
getJit-0x89eb5 clrjit+0x1732b @ 0x7fef0e7732b
PreBindAssemblyEx+0x1d9fa CreateHistoryReader-0x5526a clr+0x1207ee @ 0x7fef26407ee
PreBindAssemblyEx+0x1d94b CreateHistoryReader-0x55319 clr+0x12073f @ 0x7fef264073f
PreBindAssemblyEx+0x1d83a CreateHistoryReader-0x5542a clr+0x12062e @ 0x7fef264062e
PreBindAssemblyEx+0x1d718 CreateHistoryReader-0x5554c clr+0x12050c @ 0x7fef264050c
PreBindAssemblyEx+0x22162 CreateHistoryReader-0x50b02 clr+0x124f56 @ 0x7fef2644f56
DestroyAssemblyConfigCookie+0xb676 PreBindAssembly-0x161da clr+0xecbfa @ 0x7fef260cbfa
PreBindAssemblyEx+0x225b5 CreateHistoryReader-0x506af clr+0x1253a9 @ 0x7fef26453a9
PreBindAssemblyEx+0x1d6bd CreateHistoryReader-0x555a7 clr+0x1204b1 @ 0x7fef26404b1
StrongNameTokenFromPublicKey+0x893a SetRuntimeInfo-0x33006 clr+0x9e88a @ 0x7fef25be88a
CoUninitializeEE+0x4d7cd GetMetaDataInternalInterface-0x29f4f clr+0x50971 @ 0x7fef2570971
CoUninitializeEE+0x4cd27 GetMetaDataInternalInterface-0x2a9f5 clr+0x4fecb @ 0x7fef256fecb
DllRegisterServerInternal-0xcc6 clr+0x24da @ 0x7fef25224da
system+0x9425c @ 0x7feee8d425c
system+0x203d4e @ 0x7feeea43d4e
system+0x2038cd @ 0x7feeea438cd
system+0x1ff53c @ 0x7feeea3f53c
system+0x9a0a4 @ 0x7feee8da0a4
system+0x1ff5df @ 0x7feeea3f5df
system+0x1f4e4 @ 0x7fef30df4e4
system+0x1d1f6 @ 0x7fef30dd1f6
system+0x2272d @ 0x7fef30e272d
system+0x2224e @ 0x7fef30e224e
0x7fe92ea0144
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef256f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef256f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef256f30b
_CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef270721c
_CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef2707976
_CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef2707870
_CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef27073e6
_CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef270733e
_CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef2703ed4
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef33474e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef33e5b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7689652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76fac521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0640002
exception.offset: 42141
exception.address: 0x7fefd4da49d
registers.r14: 0
registers.r15: 0
registers.rcx: 38227752
registers.rsi: 0
registers.r10: 8789968243232
registers.rbx: 0
registers.rsp: 1964352
registers.r11: 1949440
registers.r8: 0
registers.r9: 0
registers.rdx: 38231304
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1998014141
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00741000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00742000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00743000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00744000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00745000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00746000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00438000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00747000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00748000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00749000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04eef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:24 p.m.	process_identifier: 1856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0074f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\OrcusWatchdog.exe
file	C:\Windows\SysWOW64\WindowsInput.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW July 31, 2021, 1:17 p.m.	service_start_name: start_type: 2 password: display_name: Windows Input filepath: C:\Users\test22\AppData\Local\Temp\"C:\Windows\SysWOW64\WindowsInput.exe" service_name: WindowsInput filepath_r: "C:\Windows\SysWOW64\WindowsInput.exe" desired_access: 983551 service_handle: 0x0000000002112ff0 error_control: 1 service_type: 16 service_manager_handle: 0x0000000002113110	1	34680816	0

Drops a binary and executes it (2 events)

file	C:\Windows\SysWOW64\WindowsInput.exe
file	C:\Users\test22\AppData\Local\Temp\OrcusWatchdog.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\OrcusWatchdog.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000e6600', u'virtual_address': u'0x00002000', u'entropy': 7.173051786065724, u'name': u'.text', u'virtual_size': u'0x000e64a4'}

entropy

7.17305178607

description

A section with a high entropy has been found

entropy

0.997294372294

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 31, 2021, 1:24 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 31, 2021, 1:24 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 31, 2021, 1:24 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 31, 2021, 1:24 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (2 events)

description	OrcusWatchdog.exe tried to sleep 157 seconds, actually delayed analysis time by 157 seconds
description	Orcus.exe tried to sleep 24553718 seconds, actually delayed analysis time by 24553718 seconds

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusW July 31, 2021, 1:24 p.m.	service_handle: 0x055aba98 service_type: 48 service_status: 3		0	0

Installs itself for autorun at Windows startup (2 events)

service_name	WindowsInput				service_path	C:\Users\test22\AppData\Local\Temp\"C:\Windows\SysWOW64\WindowsInput.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Orcus				reg_value	"C:\Program Files (x86)\Orcus\Orcus.exe"

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA July 31, 2021, 1:24 p.m.	thread_identifier: 0 callback_function: 0x004208fa hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00f40000	1	1245587	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.MSIL.PasswordStealerA.2A0598CC
CAT-QuickHeal	Trojan.MsilFC.S6051223
McAfee	BackDoor-FDJE!932CB9CA236E
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005011a81 )
K7GW	Trojan ( 005011a81 )
Cybereason	malicious.a236e1
Arcabit	Generic.MSIL.PasswordStealerA.2A0598CC
Cyren	W32/MSIL_Injector.KK.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Orcusrat.D
APEX	Malicious
ClamAV	Win.Packed.Passwordstealera-9752380-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Generic
BitDefender	Generic.MSIL.PasswordStealerA.2A0598CC
SUPERAntiSpyware	Trojan.Agent/Gen-Injector
Avast	Win32:CrypterX-gen [Trj]
Ad-Aware	Generic.MSIL.PasswordStealerA.2A0598CC
Sophos	ML/PE-A + Troj/OrcusRAT-A
DrWeb	Trojan.DownLoader28.34223
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	BKDR_ORCUSRAT.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.932cb9ca236e1e8c
Emsisoft	Backdoor.Orcus (A)
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanSpy.MSIL.sam
eGambit	Unsafe.AI_Score_99%
Avira	HEUR/AGEN.1128549
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.3384F4B
Microsoft	Backdoor:MSIL/Orcus.A!bit
GData	MSIL.Backdoor.Orcus.A
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/OrcusRAT.Exp
BitDefenderTheta	Gen:NN.ZemsilF.34050.5m0@auajFMb
ALYac	Generic.MSIL.PasswordStealerA.2A0598CC
Malwarebytes	Qbot.Backdoor.Stealer.DDS
Zoner	Trojan.Win32.88032
TrendMicro-HouseCall	BKDR_ORCUSRAT.SM
Rising	Backdoor.Orcus!1.B603 (CLASSIC)
Yandex	Trojan.Orcusrat!ND7vWKXUgFs
Ikarus	Trojan.MSIL.Orcusrat
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.ASJ!tr
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM03.0.EF5F.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 events)

dead_host	192.168.56.102:49166
dead_host	192.168.56.102:49167
dead_host	192.168.56.102:49170
dead_host	192.168.56.1:10134
dead_host	192.168.56.102:49168
dead_host	192.168.56.102:49169

huh.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All