popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pscueWLrAI893Mm.exe

Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 6, 2021, 9:18 a.m. Aug. 6, 2021, 9:59 a.m.
Size 820.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 028af3720307d853716bfa0f438a0746
SHA256 22f8bd6d14f40adb264992b23b49be37feeefeb00ff0702bfea5662b401ff8d6
CRC32 EF05EF84
ssdeep 12288:PBKxvx2iNyC/UaTRhdWoecpeKOERq4oZ/8N6/nfYoQamRHJqDV356Rkqh2rNls9x:EX1nnR4cobsqI6/woCHJ6J6vhAq
Yara
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49207 -> 104.21.30.11:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 104.21.30.11:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 104.21.30.11:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 199.59.242.153:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 199.59.242.153:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 199.59.242.153:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 216.239.38.21:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 216.239.38.21:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 216.239.38.21:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 107.163.207.203:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 107.163.207.203:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 107.163.207.203:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 72.1.32.168:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 72.1.32.168:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 72.1.32.168:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0079bb28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0079bb28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0079bb28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.income-academy.net/aqu2/?9r4P2=yTaVLqrhN05vYiJqrghKhV1kwkPK3wCJaLMYrf/MNipjQST+eEaDoRfCXS8xMdNgXSn1AdLb&EjU4Sz=gdMTVRIPlB
suspicious_features GET method with no useragent header suspicious_request GET http://www.golloctror.com/aqu2/?9r4P2=4uR/nYjgwVtYQYbEgqLfVeOvQ0g/0VggqoBfHm1YELVh/dVGB1YhVcaz8p3nfDlAqMtpxI2v&EjU4Sz=gdMTVRIPlB
suspicious_features GET method with no useragent header suspicious_request GET http://www.sharperimege.com/aqu2/?9r4P2=kVL+er5siNlB7pe1dLZS/sGAoq3svs4UfEDtCPtiHJKEfyVztMafNvCw4QsKRCCzR1PEWQeU&EjU4Sz=gdMTVRIPlB
suspicious_features GET method with no useragent header suspicious_request GET http://www.barrieratxfence.info/aqu2/?9r4P2=lXd4zSUgCC+Gjsky/2vKTrlJaFfVYkpLux/MwnR2z2M4YDrYm4lj055+c6MS0ib3/EWLUfQU&EjU4Sz=gdMTVRIPlB
suspicious_features GET method with no useragent header suspicious_request GET http://www.grandfinishremodeling.com/aqu2/?9r4P2=NRZUopoDI9LJwLB83JD0yzozs/oGQMk+mwWEPr2pPkzgK4yBOGRtKPbgK/BnV+66QBsVMhyW&EjU4Sz=gdMTVRIPlB
suspicious_features GET method with no useragent header suspicious_request GET http://www.mylove4tees.com/aqu2/?9r4P2=9ws66imtgg3T3b9kOnthfi50Nu6P9IVW/TE+7j+Pbvzlz2d9z3p7URmmP+8NozKSwRBm4C3L&EjU4Sz=gdMTVRIPlB
request POST http://www.income-academy.net/aqu2/
request GET http://www.income-academy.net/aqu2/?9r4P2=yTaVLqrhN05vYiJqrghKhV1kwkPK3wCJaLMYrf/MNipjQST+eEaDoRfCXS8xMdNgXSn1AdLb&EjU4Sz=gdMTVRIPlB
request POST http://www.golloctror.com/aqu2/
request GET http://www.golloctror.com/aqu2/?9r4P2=4uR/nYjgwVtYQYbEgqLfVeOvQ0g/0VggqoBfHm1YELVh/dVGB1YhVcaz8p3nfDlAqMtpxI2v&EjU4Sz=gdMTVRIPlB
request POST http://www.sharperimege.com/aqu2/
request GET http://www.sharperimege.com/aqu2/?9r4P2=kVL+er5siNlB7pe1dLZS/sGAoq3svs4UfEDtCPtiHJKEfyVztMafNvCw4QsKRCCzR1PEWQeU&EjU4Sz=gdMTVRIPlB
request POST http://www.barrieratxfence.info/aqu2/
request GET http://www.barrieratxfence.info/aqu2/?9r4P2=lXd4zSUgCC+Gjsky/2vKTrlJaFfVYkpLux/MwnR2z2M4YDrYm4lj055+c6MS0ib3/EWLUfQU&EjU4Sz=gdMTVRIPlB
request POST http://www.grandfinishremodeling.com/aqu2/
request GET http://www.grandfinishremodeling.com/aqu2/?9r4P2=NRZUopoDI9LJwLB83JD0yzozs/oGQMk+mwWEPr2pPkzgK4yBOGRtKPbgK/BnV+66QBsVMhyW&EjU4Sz=gdMTVRIPlB
request POST http://www.mylove4tees.com/aqu2/
request GET http://www.mylove4tees.com/aqu2/?9r4P2=9ws66imtgg3T3b9kOnthfi50Nu6P9IVW/TE+7j+Pbvzlz2d9z3p7URmmP+8NozKSwRBm4C3L&EjU4Sz=gdMTVRIPlB
request POST http://www.income-academy.net/aqu2/
request POST http://www.golloctror.com/aqu2/
request POST http://www.sharperimege.com/aqu2/
request POST http://www.barrieratxfence.info/aqu2/
request POST http://www.grandfinishremodeling.com/aqu2/
request POST http://www.mylove4tees.com/aqu2/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ad0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02100000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02250000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e072000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d77000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 112
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05d79000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2296
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ad0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000cbc00', u'virtual_address': u'0x00002000', u'entropy': 7.50877703666427, u'name': u'.text', u'virtual_size': u'0x000cbb44'} entropy 7.50877703666 description A section with a high entropy has been found
entropy 0.993902439024 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2660
process_handle: 0x00000288
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2660
process_handle: 0x00000288
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000278
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2296
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000028c
1 0 0
Process injection Process 112 manipulating memory of non-child process 2660
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000278
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELŠ²ôKà  r°Ð@@.text`pr `
base_address: 0x00400000
process_identifier: 2296
process_handle: 0x0000028c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2296
process_handle: 0x0000028c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELŠ²ôKà  r°Ð@@.text`pr `
base_address: 0x00400000
process_identifier: 2296
process_handle: 0x0000028c
1 1 0
Process injection Process 112 called NtSetContextThread to modify thread in remote process 2296
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313264
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000288
process_identifier: 2296
1 0 0
Process injection Process 112 resumed a thread in remote process 2296
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000288
suspend_count: 1
process_identifier: 2296
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 112
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 112
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 112
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 112
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 112
1 0 0

CreateProcessInternalW

 thread_identifier: 2704
thread_handle: 0x00000274
process_identifier: 2660
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\pscueWLrAI893Mm.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\pscueWLrAI893Mm.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000278
1 1 0

NtGetContextThread

 thread_handle: 0x00000274
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000278
3221225496 0

CreateProcessInternalW

 thread_identifier: 1940
thread_handle: 0x00000288
process_identifier: 2296
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\pscueWLrAI893Mm.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\pscueWLrAI893Mm.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000028c
1 1 0

NtGetContextThread

 thread_handle: 0x00000288
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2296
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000028c
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELŠ²ôKà  r°Ð@@.text`pr `
base_address: 0x00400000
process_identifier: 2296
process_handle: 0x0000028c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2296
process_handle: 0x0000028c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2296
process_handle: 0x0000028c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313264
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000288
process_identifier: 2296
1 0 0

NtResumeThread

 thread_handle: 0x00000288
suspend_count: 1
process_identifier: 2296
1 0 0
Elastic malicious (high confidence)
DrWeb Trojan.Inject4.14245
MicroWorld-eScan Trojan.GenericKD.46625056
FireEye Generic.mg.028af3720307d853
CAT-QuickHeal Worm.MSIL
ALYac Trojan.GenericKD.46625056
Cylance Unsafe
Zillya Trojan.Agensla.Win32.12432
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0057f5d41 )
Alibaba Trojan:Win32/Kryptik.ali2000016
K7GW Trojan ( 0057f5d41 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZemsilF.34050.Zm0@a8g@p5g
Cyren W32/MSIL_Troj.BGC.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of MSIL/GenKryptik.FHNM
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKD.46625056
Avast Win32:MalwareX-gen [Trj]
Tencent Msil.Trojan-qqpass.Qqrob.Duw
Ad-Aware Trojan.GenericKD.46625056
Sophos Mal/Generic-S
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DGE21
McAfee-GW-Edition BehavesLike.Win32.Fareit.cc
Emsisoft Trojan.Agent (A)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.PSW.MSIL.bwjq
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1142637
MAX malware (ai score=89)
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft Backdoor:MSIL/NanoBot.RKC!MTB
Gridinsoft Trojan.Win32.Downloader.sa
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData MSIL.Trojan.BSE.1NYDJC8
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.AgentTesla.C4552532
McAfee AgentTesla-FDAH!028AF3720307
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.Crypt.MSIL
TrendMicro-HouseCall TROJ_GEN.R002C0DGE21
Ikarus Trojan.Inject
MaxSecure Trojan.Malware.74499699.susgen
Fortinet MSIL/Agent.GIQ!tr
AVG Win32:MalwareX-gen [Trj]
Cybereason malicious.18184d