Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 4, 2021, 9:30 a.m.	Aug. 4, 2021, 9:35 a.m.

Size	444.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`41137fd61b9cc0d92225c91660a5902c`
SHA256	`b04306fa8223c20a1abaaa6aeb5cabb2a83dc04337beb2acfd47784b34b682bc`
CRC32	`665DB3EC`
ssdeep	`12288:bHOWiWyFfGU94mxuYfv/PT9WK+dG7VWfQTB:bHQ4mF7ZBMfwB`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

New_1007572_021.exe "C:\Users\test22\AppData\Local\Temp\New_1007572_021.exe"
760
- New_1007572_021.exe C:\Users\test22\AppData\Local\Temp\New_1007572_021.exe
  2344
  - FB_AD90.tmp.exe "C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe"
    2432
  - FB_AE1E.tmp.exe "C:\Users\test22\AppData\Local\Temp\FB_AE1E.tmp.exe"
    2472

Name	Response	Post-Analysis Lookup
www.healinghandssalem.com	CNAME healinghandssalem.com A 104.36.56.20	104.36.56.20
www.zerkalo-mr-bit-casino.com
www.xinyisanreqi.com	A 156.245.252.91	156.245.252.91
www.lvyi19.com	A 154.205.30.80	154.205.30.80

IP Address	Status	Action
104.36.56.20	Active	Moloch
154.205.30.80	Active	Moloch
156.245.252.91	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49168 -> 104.36.56.20:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 104.36.56.20:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 104.36.56.20:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 154.205.30.80:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 154.205.30.80:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 154.205.30.80:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 156.245.252.91:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 156.245.252.91:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 156.245.252.91:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 4, 2021, 9:30 a.m.			0	0
IsDebuggerPresent Aug. 4, 2021, 9:30 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 4, 2021, 9:30 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 4, 2021, 9:31 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7509b37e 0x4cfa25d 0x4cfa1d2 0x4cf7695 0x4cf710b 0x6c7fc19 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73af1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73af1737 mscorlib+0x2d36ad @ 0x721d36ad mscorlib+0x308f2d @ 0x72208f2d mscorlib+0x3135ed @ 0x722135ed 0x5c1b4c 0x5c1a0d mscorlib+0x30c9ff @ 0x7220c9ff mscorlib+0x302367 @ 0x72202367 mscorlib+0x3022a6 @ 0x722022a6 mscorlib+0x302261 @ 0x72202261 mscorlib+0x30ca7c @ 0x7220ca7c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73a82e95 DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x73b107d8 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x73ae7d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x73ae7dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x73ae7e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x73a7c3bf DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x73b10694 DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x73b8a0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7509b479 registers.esp: 105507828 registers.edi: 1955258312 registers.eax: 8781824 registers.ebp: 105508032 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 4, 2021, 9:31 a.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7509b37e
0x4cfa25d
0x4cfa1d2
0x4cf7695
0x4cf710b
0x6c7fc19
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73af1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73af1737
mscorlib+0x2d36ad @ 0x721d36ad
mscorlib+0x308f2d @ 0x72208f2d
mscorlib+0x3135ed @ 0x722135ed
0x5c1b4c
0x5c1a0d
mscorlib+0x30c9ff @ 0x7220c9ff
mscorlib+0x302367 @ 0x72202367
mscorlib+0x3022a6 @ 0x722022a6
mscorlib+0x302261 @ 0x72202261
mscorlib+0x30ca7c @ 0x7220ca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73a72652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73a8264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73a82e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x73b107d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x73ae7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x73ae7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x73ae7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x73a7c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x73b10694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x73b8a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x750733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77199ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77199ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7509b479
registers.esp: 105507828
registers.edi: 1955258312
registers.eax: 8781824
registers.ebp: 105508032
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.xinyisanreqi.com/cg53/?T8SD=IH6xuV53t1O8cgYhT4tQpi3TxtA7wfqS8uDOT7Zi29wexx3ZCGtTBXSi+TOfwYL1x8voHF35&NVlTnb=o2JhQT4HxtyDuVtP
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.lvyi19.com/cg53/?T8SD=WiiXXgOAleA7Y5gv4djo0cAbbquqgea++YKCzxIGHZZ1xQP78WGQ3riSOchSPht9pZSIkzZ4&NVlTnb=o2JhQT4HxtyDuVtP
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.healinghandssalem.com/cg53/?T8SD=i57Q5A28ObJQOLfsNs28RhAlfyvzZM0CQcr3ejFPyqD98hX6/Q6nrSa1A8B/q2hu3ufg8b08&NVlTnb=o2JhQT4HxtyDuVtP

Performs some HTTP requests (3 events)

request	GET http://www.xinyisanreqi.com/cg53/?T8SD=IH6xuV53t1O8cgYhT4tQpi3TxtA7wfqS8uDOT7Zi29wexx3ZCGtTBXSi+TOfwYL1x8voHF35&NVlTnb=o2JhQT4HxtyDuVtP
request	GET http://www.lvyi19.com/cg53/?T8SD=WiiXXgOAleA7Y5gv4djo0cAbbquqgea++YKCzxIGHZZ1xQP78WGQ3riSOchSPht9pZSIkzZ4&NVlTnb=o2JhQT4HxtyDuVtP
request	GET http://www.healinghandssalem.com/cg53/?T8SD=i57Q5A28ObJQOLfsNs28RhAlfyvzZM0CQcr3ejFPyqD98hX6/Q6nrSa1A8B/q2hu3ufg8b08&NVlTnb=o2JhQT4HxtyDuVtP

Allocates read-write-execute memory (usually to unpack itself) (48 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02050000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02052000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:30 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06c71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06c7e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06c7f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cfa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 2472 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe
file	C:\Users\test22\AppData\Local\Temp\FB_AE1E.tmp.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0006a600', u'virtual_address': u'0x00002000', u'entropy': 7.9871071074869615, u'name': u'.text', u'virtual_size': u'0x0006a594'}

entropy

7.98710710749

description

A section with a high entropy has been found

entropy

0.958333333333

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 4, 2021, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 4, 2021, 9:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: d773a251af62a92b1c571d5dd6986f1be694b764

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 2344 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2344 process_handle: 0x000002a8	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 760 called NtSetContextThread to modify thread in remote process 2344
NtSetContextThread Aug. 4, 2021, 9:31 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4198800 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a4 process_identifier: 2344	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 760 resumed a thread in remote process 2344
NtResumeThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2344	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

FireEye	Generic.mg.41137fd61b9cc0d9
Cylance	Unsafe
K7AntiVirus	Trojan ( 00577e181 )
Alibaba	Trojan:MSIL/GenKryptik.fa658a6a
K7GW	Trojan ( 00577e181 )
Cybereason	malicious.d6d344
BitDefenderTheta	Gen:NN.ZemsilF.34050.Bm0@aOOx8Ih
Cyren	W32/MSIL_Agent.BCR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FIFY
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Spy.MSIL.Noon.gen
Emsisoft	Trojan.Crypt (A)
SentinelOne	Static AI - Malicious PE
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!41137FD61B9C
Malwarebytes	Malware.AI.1615091689
Ikarus	Trojan-Spy.FormBook
MaxSecure	Trojan.Malware.300983.susgen
CrowdStrike	win/malicious_confidence_80% (D)

Executed a process and injected code into it, probably while unpacking (20 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 4, 2021, 9:30 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 760	1	0
NtResumeThread Aug. 4, 2021, 9:30 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 760	1	0
NtResumeThread Aug. 4, 2021, 9:30 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 760	1	0
NtResumeThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 760	1	0
NtGetContextThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x00000150	1	0
NtGetContextThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x00000150	1	0
NtResumeThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 760	1	0
CreateProcessInternalW Aug. 4, 2021, 9:31 a.m.	thread_identifier: 2348 thread_handle: 0x000002a4 process_identifier: 2344 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\New_1007572_021.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002a8	1	1
NtGetContextThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x000002a4	1	0
NtAllocateVirtualMemory Aug. 4, 2021, 9:31 a.m.	process_identifier: 2344 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8	1	0
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: base_address: 0x00400000 process_identifier: 2344 process_handle: 0x000002a8	1	1
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: base_address: 0x00401000 process_identifier: 2344 process_handle: 0x000002a8	1	1
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: base_address: 0x00402000 process_identifier: 2344 process_handle: 0x000002a8	1	1
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: base_address: 0x00403000 process_identifier: 2344 process_handle: 0x000002a8	1	1
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: base_address: 0x00404000 process_identifier: 2344 process_handle: 0x000002a8	1	1
WriteProcessMemory Aug. 4, 2021, 9:31 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2344 process_handle: 0x000002a8	1	1
NtSetContextThread Aug. 4, 2021, 9:31 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4198800 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a4 process_identifier: 2344	1	0
NtResumeThread Aug. 4, 2021, 9:31 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2344	1	0
CreateProcessInternalW Aug. 4, 2021, 9:31 a.m.	thread_identifier: 2436 thread_handle: 0x000002ac process_identifier: 2432 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\FB_AD90.tmp.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b4	1	1
CreateProcessInternalW Aug. 4, 2021, 9:31 a.m.	thread_identifier: 2476 thread_handle: 0x000002b0 process_identifier: 2472 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\FB_AE1E.tmp.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\FB_AE1E.tmp.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\FB_AE1E.tmp.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002b8	1	1

New_1007572_021.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All