Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 6, 2021, 9:19 a.m.	Aug. 6, 2021, 10:02 a.m.

Size	901.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c54342185881953b5e36fe05f977cc00`
SHA256	`109a5ffb53cd3311e68c5a28f84fd1d7eb668de3db43a35c344f83785187f915`
CRC32	`1FB49884`
ssdeep	`12288:8HLoR65AXwgFvuSS3sGs6+XqIXq9MZj9Iba0vWtgA7K+zqrkb1NnSzv:8roR6qgEvaiZBEacBuoe1NnMv`
Yara	Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals

plot-114.exe "C:\Users\test22\AppData\Local\Temp\plot-114.exe"
2416
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\plot-114.exe"
  2448
- plot-114.exe "C:\Users\test22\AppData\Local\Temp\plot-114.exe"
  2892

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
91.243.44.5	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 6, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 6, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 6, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 6, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 6, 2021, 10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 6, 2021, 10 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 6, 2021, 9:19 a.m.			0	0
IsDebuggerPresent Aug. 6, 2021, 9:19 a.m.			0	0
IsDebuggerPresent Aug. 6, 2021, 10 a.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\plot console_handle: 0x00000053	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: -114.exe console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Aug. 6, 2021, 10 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 6, 2021, 9:19 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c3410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 9:19 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c3410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 9:19 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c3410 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfad8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfbd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfbd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfbd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfbd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfbd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cfbd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf698 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cff58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cf7d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2021, 10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004d0458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 6, 2021, 9:19 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 187 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00657000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0064a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00646000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f79000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:19 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f7e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f7f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b59000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2416 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 6, 2021, 10 a.m.	process_identifier: 2448 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

plot-114.exe tried to sleep 137 seconds, actually delayed analysis time by 137 seconds

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\plot-114.exe"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\plot-114.exe"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 6, 2021, 9:20 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\plot-114.exe" filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000e0a00', u'virtual_address': u'0x00002000', u'entropy': 7.295659602283532, u'name': u'.text', u'virtual_size': u'0x000e09e4'}

entropy

7.29565960228

description

A section with a high entropy has been found

entropy

0.997225305216

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 6, 2021, 9:20 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 6, 2021, 10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (10 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Aug. 6, 2021, 9:20 a.m.	status_code: 0xffffffff process_identifier: 2832 process_handle: 0x00000360		0	0
NtTerminateProcess Aug. 6, 2021, 9:20 a.m.	status_code: 0xffffffff process_identifier: 2832 process_handle: 0x00000360	1	0	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 2232f56560c30cf24640dee98ee48c34cb6af1a1

Communicates with host for which no DNS query was performed (1 event)

host

91.243.44.5

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2832 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000380		3221225496	0
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2892 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000037c	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2416 manipulating memory of non-child process 2832
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2832 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000380		3221225496	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 6, 2021, 9:20 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2892 process_handle: 0x0000037c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2416 called NtSetContextThread to modify thread in remote process 2892
NtSetContextThread Aug. 6, 2021, 9:20 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4653712 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000360 process_identifier: 2892	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2416 resumed a thread in remote process 2892
NtResumeThread Aug. 6, 2021, 9:20 a.m.	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 2892	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (24 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 6, 2021, 9:19 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2416	1	0
NtResumeThread Aug. 6, 2021, 9:19 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2416	1	0
NtResumeThread Aug. 6, 2021, 9:19 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2416	1	0
NtResumeThread Aug. 6, 2021, 9:19 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2416	1	0
NtGetContextThread Aug. 6, 2021, 9:19 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Aug. 6, 2021, 9:19 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2416	1	0
NtResumeThread Aug. 6, 2021, 9:20 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2416	1	0
CreateProcessInternalW Aug. 6, 2021, 9:20 a.m.	thread_identifier: 1420 thread_handle: 0x000003a8 process_identifier: 2448 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\plot-114.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b0	1	1
CreateProcessInternalW Aug. 6, 2021, 9:20 a.m.	thread_identifier: 2692 thread_handle: 0x00000280 process_identifier: 2832 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\plot-114.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\plot-114.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000380	1	1
NtGetContextThread Aug. 6, 2021, 9:20 a.m.	thread_handle: 0x00000280	1	0
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2832 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000380		3221225496
CreateProcessInternalW Aug. 6, 2021, 9:20 a.m.	thread_identifier: 200 thread_handle: 0x00000360 process_identifier: 2892 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\plot-114.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\plot-114.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000037c	1	1
NtGetContextThread Aug. 6, 2021, 9:20 a.m.	thread_handle: 0x00000360	1	0
NtAllocateVirtualMemory Aug. 6, 2021, 9:20 a.m.	process_identifier: 2892 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000037c	1	0
WriteProcessMemory Aug. 6, 2021, 9:20 a.m.	buffer: base_address: 0x00400000 process_identifier: 2892 process_handle: 0x0000037c	1	1
WriteProcessMemory Aug. 6, 2021, 9:20 a.m.	buffer: base_address: 0x00442000 process_identifier: 2892 process_handle: 0x0000037c	1	1
WriteProcessMemory Aug. 6, 2021, 9:20 a.m.	buffer: base_address: 0x00471000 process_identifier: 2892 process_handle: 0x0000037c	1	1
WriteProcessMemory Aug. 6, 2021, 9:20 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2892 process_handle: 0x0000037c	1	1
NtSetContextThread Aug. 6, 2021, 9:20 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4653712 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000360 process_identifier: 2892	1	0
NtResumeThread Aug. 6, 2021, 9:20 a.m.	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 2892	1	0
NtResumeThread Aug. 6, 2021, 10 a.m.	thread_handle: 0x0000029c suspend_count: 1 process_identifier: 2448	1	0
NtResumeThread Aug. 6, 2021, 10 a.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2448	1	0
NtResumeThread Aug. 6, 2021, 10 a.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 2448	1	0
NtResumeThread Aug. 6, 2021, 10 a.m.	thread_handle: 0x000004ac suspend_count: 1 process_identifier: 2448	1	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Lionic	Trojan.MSIL.Androm.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.c54342185881953b
CAT-QuickHeal	Backdoor.Fynloski.A3
McAfee	Artemis!C54342185881
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/MSIL_Kryptik.DZG.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.ACGQ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Backdoor.MSIL.Remcos.gen
Avast	Win32:PWSX-gen [Trj]
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
eGambit	Unsafe.AI_Score_51%
Microsoft	Trojan:MSIL/AgentTesla.CFM!MTB
ZoneAlarm	UDS:DangerousObject.Multi.Generic
BitDefenderTheta	Gen:NN.ZemsilF.34058.4m0@aixdyFl
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
Malwarebytes	MachineLearning/Anomalous.95%
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.DZG!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.7ad8f4
Qihoo-360	Win32/Heur.Generic.HwMADx4A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (28 events)

dead_host	192.168.56.101:49222
dead_host	192.168.56.101:49211
dead_host	192.168.56.101:49206
dead_host	192.168.56.101:49219
dead_host	192.168.56.101:49215
dead_host	91.243.44.5:5149
dead_host	192.168.56.101:49223
dead_host	192.168.56.101:49203
dead_host	192.168.56.101:49224
dead_host	192.168.56.101:49207
dead_host	192.168.56.101:49228
dead_host	192.168.56.101:49208
dead_host	192.168.56.101:49216
dead_host	192.168.56.101:49212
dead_host	192.168.56.101:49225
dead_host	192.168.56.101:49220
dead_host	192.168.56.101:49229
dead_host	192.168.56.101:49209
dead_host	192.168.56.101:49204
dead_host	192.168.56.101:49217
dead_host	192.168.56.101:49213
dead_host	192.168.56.101:49226
dead_host	192.168.56.101:49221
dead_host	192.168.56.101:49210
dead_host	192.168.56.101:49205
dead_host	192.168.56.101:49218
dead_host	192.168.56.101:49214
dead_host	192.168.56.101:49227

plot-114.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All