Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 14, 2021, 9:30 a.m.	Aug. 14, 2021, 9:44 a.m.

Size	13.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9388365245c1d52f5aebc8a3ef352665`
SHA256	`610ba149c7874ac9c4e30d8a65ae5bb8a94d68d544ce97e8337cdeb75a8ed674`
CRC32	`78BA0A65`
ssdeep	`384:XgUBapggoGRNMNiM5NmbZSIu4GloptYcFSVc03K:xapggoGRNMNf5EbVil8tYcFSVc6K`
PDB Path	C:\Users\Administrator\Desktop\BotSh1zoid\BotSh1zoid\bin\Release\BuildPacker\BuildPacker\obj\Release\BuildPacker.pdb
Yara	Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Downloader.exe "C:\Users\test22\AppData\Local\Temp\Downloader.exe"
1280
- powershell.exe "powershell" Get-MpPreference -verbose
  2088

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
95.181.155.150	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49165 -> 95.181.155.150:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 95.181.155.150:80 -> 192.168.56.102:49165	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 95.181.155.150:80 -> 192.168.56.102:49165	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 95.181.155.150:80 -> 192.168.56.102:49165	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 14, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 14, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 14, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 14, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Aug. 14, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 14, 2021, 9:23 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 14, 2021, 9:23 a.m.			0	0
IsDebuggerPresent Aug. 14, 2021, 9:23 a.m.			0	0
IsDebuggerPresent Aug. 14, 2021, 9:23 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001d8150 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000251320 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000251320 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000251320 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba37da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba37da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba37e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba37e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba37e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba37e80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38740 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38900 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba389e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba389e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba389e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b6450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b6450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b6450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001b6450 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba5d4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba5d4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba5d820 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba5d820 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 14, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba38660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\BotSh1zoid\BotSh1zoid\bin\Release\BuildPacker\BuildPacker\obj\Release\BuildPacker.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 14, 2021, 9:23 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://95.181.155.150/files/release.exe

Performs some HTTP requests (1 event)

request

GET http://95.181.155.150/files/release.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 228 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1431000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1acb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91df1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91df2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 14, 2021, 9:23 a.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sbvc.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"powershell" Get-MpPreference -verbose

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sbvc.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Aug. 14, 2021, 9:23 a.m.	thread_identifier: 360 thread_handle: 0x000000000000022c process_identifier: 2088 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000000000000238	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 14, 2021, 9:23 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 14, 2021, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

95.181.155.150

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Disables Windows Security features (4 events)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Johnnie.368657
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	GenericRXOO-QW!9388365245C1
K7AntiVirus	Trojan ( 005732f31 )
K7GW	Trojan ( 005732f31 )
Cybereason	malicious.245c1d
Cyren	W32/MSIL_Kryptik.EDT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.THY
APEX	Malicious
ClamAV	Win.Malware.Ursu-9794593-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Johnnie.368657
Avast	Win32:TrojanX-gen [Trj]
Ad-Aware	Gen:Variant.Johnnie.368657
DrWeb	BackDoor.DarkCrystalNET.7
McAfee-GW-Edition	GenericRXOO-QW!9388365245C1
FireEye	Generic.mg.9388365245c1d52f
Emsisoft	Gen:Variant.Johnnie.368657 (B)
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1143289
MAX	malware (ai score=81)
Microsoft	Trojan:MSIL/AntiWD.YA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Johnnie.368657
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.LF.C4385804
BitDefenderTheta	Gen:NN.ZemsilF.34058.am0@aqgiwtc
ALYac	Gen:Variant.Johnnie.368657
Malwarebytes	Trojan.Downloader
Ikarus	Trojan-Downloader.MSIL.Tiny
eGambit	Unsafe.AI_Score_70%
Fortinet	MSIL/Agent.THY!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)

Downloader.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All