Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 1, 2021, 9:14 a.m.	Aug. 1, 2021, 9:18 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a1ddbca18b0bae182a2c4d233ffda97f`
SHA256	`a691c78fb1c2f120672d6b78e38e763bbaa8211757889dc6d1537cee797f9301`
CRC32	`41028840`
ssdeep	`24576:mWJ1ZoSc7FUPxXaiuW5oHOv9tGpclP3k55uQf98Etgg15OW43:31ZcFUv5oHQ9tGu323L3r43`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
2056
- vpn.exe "C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe"
  2160
  - dllhost.exe dllhost.exe
    2268
  - cmd.exe cmd /c cmd < Fai.jpeg
    2332
    - cmd.exe cmd
      2396
      - findstr.exe findstr /V /R "^TwATKAwKAezIOSeaYlaFfsSDMabmambYSGnFSJqOhykElIlMknzqkbuCpWuseBawExQixvAfpEapyhztiKhTyvMcAVcVCILMNlZPSraPYtQHt$" Salire.jpeg
        2448
      - Imaginato.exe.com Imaginato.exe.com c
        2496
        
        Imaginato.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com c
        2564
        
        Imaginato.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com
        2892
      - PING.EXE ping localhost -n 30
        2616
- 4.exe "C:\Users\test22\AppData\Local\Temp\New Feature\4.exe"
  2196

Name	Response	Post-Analysis Lookup
SGvVgDjtanUqGtdEnmam.SGvVgDjtanUqGtdEnmam

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 1, 2021, 9:14 a.m.			0	0
IsDebuggerPresent Aug. 1, 2021, 9:14 a.m.			0	0
IsDebuggerPresent Aug. 1, 2021, 9:14 a.m.			0	0

Command line console output was observed (50 out of 89 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: Set aBQSXZuOPTEgeSJhClLoGnrZdj=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: Set OoivWSLSupBuWIPYrYHhM=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: Set kWNkyxNrRpanQTL=ping localhost -n console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: if %computername%==%aBQSXZuOPTEgeSJhClLoGnrZdj% exit console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: Set zwJcW=MZ console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: <nul set /p = "%zwJcW%" > Imaginato.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: findstr /V /R "^TwATKAwKAezIOSeaYlaFfsSDMabmambYSGnFSJqOhykElIlMknzqkbuCpWuseBawExQixvAfpEapyhztiKhTyvMcAVcVCILMNlZPSraPYtQHt$" Salire.jpeg >> Imaginato.exe.com" console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: copy Pieghi.jpeg c console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: start Imaginato.exe.com c console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:14 a.m.	buffer: %kWNkyxNrRpanQTL% 30 console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:15 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2021, 9:15 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2021, 9:14 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 1, 2021, 9:14 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x767a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c13000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x033f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2196 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2021, 9:14 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2021, 9:15 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Aug. 1, 2021, 9:14 a.m.	number_of_free_clusters: 3005239 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Aug. 1, 2021, 9:14 a.m.	number_of_free_clusters: 3005239 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (7 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com
file	C:\Users\test22\AppData\Local\Temp\nsl559E.tmp\UAC.dll
file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\4.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\nsl559E.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\4.exe
file	C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost -n 30

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 9510c14715c5f4dd7970cfff482edfb19c2bf9a6

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 1, 2021, 9:15 a.m.	process_identifier: 2892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 159744 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 process_handle: 0x00000220	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\AVG

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

reg_value

rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 1, 2021, 9:15 a.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 2892 process_handle: 0x00000220	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2564 called NtSetContextThread to modify thread in remote process 2892
NtSetContextThread Aug. 1, 2021, 9:15 a.m.	registers.eip: 1997996484 registers.esp: 5897076 registers.edi: 0 registers.eax: 1071390 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000021c process_identifier: 2892	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2396 resumed a thread in remote process 2496
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x00000134 suspend_count: 0 process_identifier: 2496	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
McAfee	GenericRXAA-FA!A1DDBCA18B0B
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZexaF.34050.wuW@ae4t4JkG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/ClipBanker.IR
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Filerepmalware-9864117-0
Kaspersky	Backdoor.Win32.Agent.myucpd
SUPERAntiSpyware	Trojan.Agent/GenericKD
Emsisoft	Trojan.Crypt (A)
McAfee-GW-Edition	BehavesLike.Win32.SystemHealer.tc
Sophos	Troj/Agent-BHFT
Microsoft	Trojan:Win32/Caynamer.A!ml
GData	Win32.Trojan.BSE.HLJWVB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Trojan-gen.C4479862
Malwarebytes	Malware.AI.4024116118
Rising	Trojan.Kryptik!1.C6FC (CLASSIC)
eGambit	Unsafe.AI_Score_99%
Cybereason	malicious.628dbb

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2164 thread_handle: 0x0000022c process_identifier: 2160 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000230	1	1
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2200 thread_handle: 0x00000230 process_identifier: 2196 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\New Feature\4.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000022c	1	1
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2160	1	0
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2272 thread_handle: 0x00000190 process_identifier: 2268 current_directory: filepath: track: 1 command_line: dllhost.exe filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000018c	1	1
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2336 thread_handle: 0x0000018c process_identifier: 2332 current_directory: filepath: track: 1 command_line: cmd /c cmd < Fai.jpeg filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000190	1	1
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2400 thread_handle: 0x0000012c process_identifier: 2396 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000130	1	1
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2452 thread_handle: 0x00000130 process_identifier: 2448 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^TwATKAwKAezIOSeaYlaFfsSDMabmambYSGnFSJqOhykElIlMknzqkbuCpWuseBawExQixvAfpEapyhztiKhTyvMcAVcVCILMNlZPSraPYtQHt$" Salire.jpeg filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2500 thread_handle: 0x00000134 process_identifier: 2496 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com track: 1 command_line: Imaginato.exe.com c filepath_r: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
NtResumeThread Aug. 1, 2021, 9:14 a.m.	thread_handle: 0x00000134 suspend_count: 0 process_identifier: 2496	1	0
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2620 thread_handle: 0x00000138 process_identifier: 2616 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping localhost -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000134	1	1
CreateProcessInternalW Aug. 1, 2021, 9:14 a.m.	thread_identifier: 2568 thread_handle: 0x0000014c process_identifier: 2564 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com c filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000150	1	1
CreateProcessInternalW Aug. 1, 2021, 9:15 a.m.	thread_identifier: 2896 thread_handle: 0x0000021c process_identifier: 2892 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Imaginato.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000220	1	1
NtGetContextThread Aug. 1, 2021, 9:15 a.m.	thread_handle: 0x0000021c	1	0
NtAllocateVirtualMemory Aug. 1, 2021, 9:15 a.m.	process_identifier: 2892 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00100000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000220	1	0
WriteProcessMemory Aug. 1, 2021, 9:15 a.m.	buffer: base_address: 0x00100000 process_identifier: 2892 process_handle: 0x00000220	1	1
WriteProcessMemory Aug. 1, 2021, 9:15 a.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 2892 process_handle: 0x00000220	1	1
NtSetContextThread Aug. 1, 2021, 9:15 a.m.	registers.eip: 1997996484 registers.esp: 5897076 registers.edi: 0 registers.eax: 1071390 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000021c process_identifier: 2892	1	0

lv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All