popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

5KNTQd5xFuY7hcE.exe

Generic Malware UPX PWS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 6, 2021, 7:30 a.m. Aug. 6, 2021, 7:32 a.m.
Size 696.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 94589c900f582c827be848f069c01983
SHA256 04e127c5bdf94f075639d7f44badd25223f3ebeede44258367413d8463505020
CRC32 39D803B5
ssdeep 12288:gtWrVHYuWorkU44r2nsjyqJBGKg3p/4F6tDnrJ/4WDO9XM4vuLR1xWWU8XBq3E:gFmB4yvODmevKWDe8UeBq3E
Yara
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:65329 -> 164.124.101.2:53 2027870 ET INFO Observed DNS Query to .world TLD Potentially Bad Traffic
TCP 192.168.56.101:49209 -> 88.214.207.96:80 2027879 ET INFO HTTP Request to Suspicious *.world Domain Potentially Bad Traffic
TCP 192.168.56.101:49210 -> 88.214.207.96:80 2027879 ET INFO HTTP Request to Suspicious *.world Domain Potentially Bad Traffic
TCP 192.168.56.101:49210 -> 88.214.207.96:80 2027879 ET INFO HTTP Request to Suspicious *.world Domain Potentially Bad Traffic
TCP 192.168.56.101:49206 -> 74.208.236.33:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 74.208.236.33:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 74.208.236.33:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 104.17.193.73:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 104.17.193.73:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 104.17.193.73:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 209.99.40.222:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 209.99.40.222:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80 2027879 ET INFO HTTP Request to Suspicious *.world Domain Potentially Bad Traffic
TCP 192.168.56.101:49218 -> 209.99.40.222:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0090d8a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0090dea8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0090dea8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.urnasaurora.com/qn6g/?0T0hqZ=5Y9nApRHUyNLbSfQ171lqWRj5joN9fSwp1QGW3momieNUj8sOfwA08LvtX9P3kpa1WNCZiqL&OVolp=AZ0tZJ_pEPh43080
suspicious_features GET method with no useragent header suspicious_request GET http://www.worldanimaltransport.com/qn6g/?0T0hqZ=apmNFC6wkW3L3p0KxKMAeJrXLsRqAofgoows/2qMdUZEN6MNld+3DxAiO98nziQ0UfmIglJu&OVolp=AZ0tZJ_pEPh43080
suspicious_features GET method with no useragent header suspicious_request GET http://www.simplebox.world/qn6g/?0T0hqZ=QzGdtZSg8F8akSN5k2pwjBb1FoPlCuw1Z5l/Lc1JaRwV2an5McgvcAWHPZORd5AWYai5oOn7&OVolp=AZ0tZJ_pEPh43080
suspicious_features GET method with no useragent header suspicious_request GET http://www.chrometoasterrv.com/qn6g/?0T0hqZ=Fu3e8Nqpz+5+4FFaMeLJFH8Y30L7aCtlHBAsEYD/lc+R0ObJ136ak+iAozdvD8t+lE9r+PDd&OVolp=AZ0tZJ_pEPh43080
suspicious_features GET method with no useragent header suspicious_request GET http://www.realerestate.com/qn6g/?0T0hqZ=k66MBPypCsjes+y1e9EluxPQ2Zkme3f+3eM9mAYHQz9IRw3EnYLUoNudVCGsJICkZUZ+i8GN&OVolp=AZ0tZJ_pEPh43080
suspicious_features GET method with no useragent header suspicious_request GET http://www.allginns.com/qn6g/?0T0hqZ=r/7ECEpyuLrl96sv3d04QY9imYp0ltOAHLsmvfsK+GKQs1owXP9P0ZrY4mT91OO/sPuUkovN&OVolp=AZ0tZJ_pEPh43080
suspicious_features GET method with no useragent header suspicious_request GET http://www.teknotelhosting.com/qn6g/?0T0hqZ=z8YI+6R51yEnnKDGqwsBPLquhlUb7UH9xAVfqr/XXjokYAlQoscKbsf1ULkytZXIFt5bhUgo&OVolp=AZ0tZJ_pEPh43080
request POST http://www.urnasaurora.com/qn6g/
request GET http://www.urnasaurora.com/qn6g/?0T0hqZ=5Y9nApRHUyNLbSfQ171lqWRj5joN9fSwp1QGW3momieNUj8sOfwA08LvtX9P3kpa1WNCZiqL&OVolp=AZ0tZJ_pEPh43080
request POST http://www.worldanimaltransport.com/qn6g/
request GET http://www.worldanimaltransport.com/qn6g/?0T0hqZ=apmNFC6wkW3L3p0KxKMAeJrXLsRqAofgoows/2qMdUZEN6MNld+3DxAiO98nziQ0UfmIglJu&OVolp=AZ0tZJ_pEPh43080
request POST http://www.simplebox.world/qn6g/
request GET http://www.simplebox.world/qn6g/?0T0hqZ=QzGdtZSg8F8akSN5k2pwjBb1FoPlCuw1Z5l/Lc1JaRwV2an5McgvcAWHPZORd5AWYai5oOn7&OVolp=AZ0tZJ_pEPh43080
request POST http://www.chrometoasterrv.com/qn6g/
request GET http://www.chrometoasterrv.com/qn6g/?0T0hqZ=Fu3e8Nqpz+5+4FFaMeLJFH8Y30L7aCtlHBAsEYD/lc+R0ObJ136ak+iAozdvD8t+lE9r+PDd&OVolp=AZ0tZJ_pEPh43080
request POST http://www.realerestate.com/qn6g/
request GET http://www.realerestate.com/qn6g/?0T0hqZ=k66MBPypCsjes+y1e9EluxPQ2Zkme3f+3eM9mAYHQz9IRw3EnYLUoNudVCGsJICkZUZ+i8GN&OVolp=AZ0tZJ_pEPh43080
request POST http://www.allginns.com/qn6g/
request GET http://www.allginns.com/qn6g/?0T0hqZ=r/7ECEpyuLrl96sv3d04QY9imYp0ltOAHLsmvfsK+GKQs1owXP9P0ZrY4mT91OO/sPuUkovN&OVolp=AZ0tZJ_pEPh43080
request POST http://www.teknotelhosting.com/qn6g/
request GET http://www.teknotelhosting.com/qn6g/?0T0hqZ=z8YI+6R51yEnnKDGqwsBPLquhlUb7UH9xAVfqr/XXjokYAlQoscKbsf1ULkytZXIFt5bhUgo&OVolp=AZ0tZJ_pEPh43080
request POST http://www.urnasaurora.com/qn6g/
request POST http://www.worldanimaltransport.com/qn6g/
request POST http://www.simplebox.world/qn6g/
request POST http://www.chrometoasterrv.com/qn6g/
request POST http://www.realerestate.com/qn6g/
request POST http://www.allginns.com/qn6g/
request POST http://www.teknotelhosting.com/qn6g/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02200000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00372000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0038c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0037a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0039a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00397000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0038a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00396000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00641000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e632000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00644000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00645000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00646000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0037c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00647000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021cf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00648000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00649000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0038d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0038e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0038f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b80000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000a9400', u'virtual_address': u'0x00002000', u'entropy': 7.921281647219486, u'name': u'.text', u'virtual_size': u'0x000a9378'} entropy 7.92128164722 description A section with a high entropy has been found
entropy 0.972701149425 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1296
process_handle: 0x0000028c
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1296
process_handle: 0x0000028c
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1204
process_handle: 0x00000298
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1204
process_handle: 0x00000298
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 808
process_handle: 0x000002a0
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 808
process_handle: 0x000002a0
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1568
process_handle: 0x000002a8
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1568
process_handle: 0x000002a8
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1296
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000027c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1204
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 808
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000294
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1568
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000029c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002a4
1 0 0
Process injection Process 1116 manipulating memory of non-child process 1296
Process injection Process 1116 manipulating memory of non-child process 1204
Process injection Process 1116 manipulating memory of non-child process 808
Process injection Process 1116 manipulating memory of non-child process 1568
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1296
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000027c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1204
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 808
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000294
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1568
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000029c
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL»ô­Tà  pPЀ@€@.textpp `
base_address: 0x00400000
process_identifier: 2908
process_handle: 0x000002a4
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2908
process_handle: 0x000002a4
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL»ô­Tà  pPЀ@€@.textpp `
base_address: 0x00400000
process_identifier: 2908
process_handle: 0x000002a4
1 1 0
Process injection Process 1116 called NtSetContextThread to modify thread in remote process 2908
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002a8
process_identifier: 2908
1 0 0
Process injection Process 1116 resumed a thread in remote process 2908
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002a8
suspend_count: 1
process_identifier: 2908
1 0 0
Lionic Trojan.MSIL.Taskun.4!c
Elastic malicious (high confidence)
Cylance Unsafe
Alibaba Trojan:Application/Generic.8ca7cc22
Cybereason malicious.592b90
Cyren W32/MSIL_Kryptik.EBN.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of MSIL/GenKryptik.FILR
APEX Malicious
Paloalto generic.ml
Kaspersky VHO:Trojan.MSIL.Taskun.gen
Avast Win32:PWSX-gen [Trj]
DrWeb Trojan.PackedNET.964
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
FireEye Generic.mg.94589c900f582c82
SentinelOne Static AI - Malicious PE
Avira HEUR/AGEN.1142734
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 100)
McAfee Artemis!94589C900F58
VBA32 Malware-Cryptor.MSIL.AgentTesla.Heur
Malwarebytes MachineLearning/Anomalous.100%
Yandex Trojan.AvsArher.bTJEKx
Ikarus Trojan.Inject
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.DZG!tr
AVG Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_60% (W)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 1116
1 0 0

CreateProcessInternalW

 thread_identifier: 2312
thread_handle: 0x00000278
process_identifier: 1296
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000027c
1 1 0

NtGetContextThread

 thread_handle: 0x00000278
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1296
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000027c
3221225496 0

CreateProcessInternalW

 thread_identifier: 2880
thread_handle: 0x0000028c
process_identifier: 1204
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000290
1 1 0

NtGetContextThread

 thread_handle: 0x0000028c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1204
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
3221225496 0

CreateProcessInternalW

 thread_identifier: 2656
thread_handle: 0x00000298
process_identifier: 808
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000294
1 1 0

NtGetContextThread

 thread_handle: 0x00000298
1 0 0

NtAllocateVirtualMemory

 process_identifier: 808
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000294
3221225496 0

CreateProcessInternalW

 thread_identifier: 200
thread_handle: 0x000002a0
process_identifier: 1568
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000029c
1 1 0

NtGetContextThread

 thread_handle: 0x000002a0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1568
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000029c
3221225496 0

CreateProcessInternalW

 thread_identifier: 2552
thread_handle: 0x000002a8
process_identifier: 2908
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\5KNTQd5xFuY7hcE.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002a4
1 1 0

NtGetContextThread

 thread_handle: 0x000002a8
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002a4
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL»ô­Tà  pPЀ@€@.textpp `
base_address: 0x00400000
process_identifier: 2908
process_handle: 0x000002a4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2908
process_handle: 0x000002a4
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2908
process_handle: 0x000002a4
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002a8
process_identifier: 2908
1 0 0

NtResumeThread

 thread_handle: 0x000002a8
suspend_count: 1
process_identifier: 2908
1 0 0