Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 18, 2021, 11:15 a.m.	Aug. 18, 2021, 11:28 a.m.

Size	547.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`aba88ae23ef00a022dd6a09105b5a740`
SHA256	`7711ab515c2fe669a40d2ee4883ededba88dff7c305008df222c2133469215e8`
CRC32	`19D41B89`
ssdeep	`12288:TqnOm3Yx8DHoPDZKGdXdsXEJiY6L6/prI+WK:T+OmRoPwJ0JiF+/51`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Malicious_Packer_Zero - Malicious Packer

test.exe "C:\Users\test22\AppData\Local\Temp\test.exe"
1768

Name	Response	Post-Analysis Lookup
ipinfo.io	A 34.117.59.81	34.117.59.81

IP Address	Status	Action
164.124.101.2	Active	Moloch
34.117.59.81	Active	Moloch
94.250.250.235	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49165 -> 34.117.59.81:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49165 -> 34.117.59.81:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 34.117.59.81:443 -> 192.168.56.102:49165	2025330	ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49165 34.117.59.81:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1D4	CN=ipinfo.io	2a:93:c5:f6:21:4b:14:40:41:d9:36:fe:ff:fe:65:37:17:1c:4e:b8

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 18, 2021, 11:09 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 18, 2021, 11:08 a.m.			0	0
IsDebuggerPresent Aug. 18, 2021, 11:08 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 18, 2021, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ac8abd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2021, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ac8abd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 18, 2021, 11:08 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000489710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2021, 11:08 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 18, 2021, 11:09 a.m.	stacktrace: 0x7fe91ded479 0x7fe91de5270 mscorlib+0x4ef8a5 @ 0x7fef039f8a5 mscorlib+0x4ef609 @ 0x7fef039f609 mscorlib+0x4ef5c7 @ 0x7fef039f5c7 mscorlib+0x502d21 @ 0x7fef03b2d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef147f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef147f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef147f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef1646291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef1526d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef1526d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef1526c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef1526dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef1646175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef15b66ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521 exception.instruction_r: 80 38 00 48 8b 4d 08 e8 3b 97 4b 5e 48 89 45 40 exception.instruction: cmp byte ptr [rax], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe91ded479 registers.r14: 0 registers.r15: 0 registers.rcx: 485355272 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 485358192 registers.r11: 485352608 registers.r8: 4 registers.r9: 0 registers.rdx: 37252160 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 18, 2021, 11:09 a.m.

stacktrace:

0x7fe91ded479
0x7fe91de5270
mscorlib+0x4ef8a5 @ 0x7fef039f8a5
mscorlib+0x4ef609 @ 0x7fef039f609
mscorlib+0x4ef5c7 @ 0x7fef039f5c7
mscorlib+0x502d21 @ 0x7fef03b2d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef147f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef147f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef147f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef1646291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef1526d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef1526d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef1526c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef1526dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef1646175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef15b66ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521

exception.instruction_r: 80 38 00 48 8b 4d 08 e8 3b 97 4b 5e 48 89 45 40
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe91ded479
registers.r14: 0
registers.r15: 0
registers.rcx: 485355272
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 485358192
registers.r11: 485352608
registers.r8: 4
registers.r9: 0
registers.rdx: 37252160
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://94.250.250.235/generatormobile/supportmobile/phpframe/php/localServerdataMath/antiprodhtoppool/ruleServerWar/prod/phpcutrule/record/WarpluginCam/plugincore/limit/videoLinesecurebigloadsql.php?mUWINaN1N=Ur43rwNkS1171bo7LvYKuCD7w8UeNy&4ArJZZqocC0oXYpd4dPOcdCMSn=GsbsXeB76KRPifG6H4XpiHfZA7jXb8&2e9269593588ab5e818b73fe346396bb=b4e4b44a4edea5bc8fb1abfd40e9a1d3&2500729ed790d9e03c4ceedb9e2db3bc=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&mUWINaN1N=Ur43rwNkS1171bo7LvYKuCD7w8UeNy&4ArJZZqocC0oXYpd4dPOcdCMSn=GsbsXeB76KRPifG6H4XpiHfZA7jXb8
suspicious_features	Connection to IP address	suspicious_request	GET http://94.250.250.235/generatormobile/supportmobile/phpframe/php/localServerdataMath/antiprodhtoppool/ruleServerWar/prod/phpcutrule/record/WarpluginCam/plugincore/limit/videoLinesecurebigloadsql.php?mUWINaN1N=Ur43rwNkS1171bo7LvYKuCD7w8UeNy&4ArJZZqocC0oXYpd4dPOcdCMSn=GsbsXeB76KRPifG6H4XpiHfZA7jXb8&e6b8a2644710640e4511bfccb03bd803=gZjVTYxMzM5I2M4IjY5QWOzQGMwADNiZWZjRGO2Y2N1YDOmJWYmdDO2IzM1YDO2ATOygTM4UzM&2500729ed790d9e03c4ceedb9e2db3bc=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&81b9737c426f2137f2a2d127f1a0d829=d1nIwQTZ0YTO1EGZjZTY2QWO0YDZzMmZ2MjYjlTYzI2NhZzNldDO1IWYlJiOiEGN4MjZ1QWMwMzN3UzN4MTY4gjY4QGZ3QTY4gDNwgTNiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiQWMmVGO1kTO0cjYxIDZ2IGZ1gzN0ADZkJGZ0kzMhlzMis3W&bb3b58c93e9d9450e62ead05b2c56a7c=QX9JiI6IiY3ImY2MWY0UWM4EWYkJzNlFDZ1ETOlVmY4UGOmZzM5ICLiADNlRjN5UTYkNmNhZDZ5QjNkNzYmZzMiNWOhNjY3EmN3U2N4UjYhVmI6ISY0gzMmVDZxAzM3cTN3gzMhhDOihDZkdDNhhDO0ADO1ICLiUDMmVjM3QTNwcTZlVDOjRjMjRTZwcjMmBjNzYWNmNGNmJTY3QGOycjI6ICZxYWZ4UTO5QzNiFjMkZjYkVDO3QDMkRmYkRTOzEWOzIyes0nIRZWaJhlWuZUbihWMFlEdG12YulTbjFlSp9UajNjYrVzVhhlUxElQKNETptGbJZTSpJGcxckWC5EWhl2dpl0TKl2TpBzVZpmSXpFWOhVYpdXaJplSp9UaV1mY2h2RjZnSzkFcxAzYwp0QMl2atNGaOhlWqZFSRl2bqlESGVkVpdXaJBDbtF1ZRpmTnRDMTd2dXlVd5cVY65EWa1WOtNWUClnTn10MkZnUtJGckxWS2kUajxmWsJGckxWSzBjbJhmVtNmd0VUSvJFWkZnTGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJVzZU1Ee0knT5VERMlXRE1UM0knT6lUaPlWTyI2cKNETplUMTl2bqlUNKhEZ1Z1MipmSDxUa3dFZ2ZlMVl2bqlUd5cVYuZVbjl2dplUMkdFToJ0MaVXOyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWS3RzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiI2NiJmNjFGNlFDOhFGZycTZxQWNxkTZlJGOlhjZ2MTOiwiIhFmZ2ETYxQmZxQGMjVWZjhzYzYDZxE2YkVjMjJzN3ADZiFmY3EjNmJiOiEGN4MjZ1QWMwMzN3UzN4MTY4gjY4QGZ3QTY4gDNwgTNiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiQWMmVGO1kTO0cjYxIDZ2IGZ1gzN0ADZkJGZ0kzMhlzMis3W
suspicious_features	GET method with no useragent header	suspicious_request	GET https://ipinfo.io/json

Performs some HTTP requests (3 events)

request	GET http://94.250.250.235/generatormobile/supportmobile/phpframe/php/localServerdataMath/antiprodhtoppool/ruleServerWar/prod/phpcutrule/record/WarpluginCam/plugincore/limit/videoLinesecurebigloadsql.php?mUWINaN1N=Ur43rwNkS1171bo7LvYKuCD7w8UeNy&4ArJZZqocC0oXYpd4dPOcdCMSn=GsbsXeB76KRPifG6H4XpiHfZA7jXb8&2e9269593588ab5e818b73fe346396bb=b4e4b44a4edea5bc8fb1abfd40e9a1d3&2500729ed790d9e03c4ceedb9e2db3bc=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&mUWINaN1N=Ur43rwNkS1171bo7LvYKuCD7w8UeNy&4ArJZZqocC0oXYpd4dPOcdCMSn=GsbsXeB76KRPifG6H4XpiHfZA7jXb8
request	GET http://94.250.250.235/generatormobile/supportmobile/phpframe/php/localServerdataMath/antiprodhtoppool/ruleServerWar/prod/phpcutrule/record/WarpluginCam/plugincore/limit/videoLinesecurebigloadsql.php?mUWINaN1N=Ur43rwNkS1171bo7LvYKuCD7w8UeNy&4ArJZZqocC0oXYpd4dPOcdCMSn=GsbsXeB76KRPifG6H4XpiHfZA7jXb8&e6b8a2644710640e4511bfccb03bd803=gZjVTYxMzM5I2M4IjY5QWOzQGMwADNiZWZjRGO2Y2N1YDOmJWYmdDO2IzM1YDO2ATOygTM4UzM&2500729ed790d9e03c4ceedb9e2db3bc=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&81b9737c426f2137f2a2d127f1a0d829=d1nIwQTZ0YTO1EGZjZTY2QWO0YDZzMmZ2MjYjlTYzI2NhZzNldDO1IWYlJiOiEGN4MjZ1QWMwMzN3UzN4MTY4gjY4QGZ3QTY4gDNwgTNiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiQWMmVGO1kTO0cjYxIDZ2IGZ1gzN0ADZkJGZ0kzMhlzMis3W&bb3b58c93e9d9450e62ead05b2c56a7c=QX9JiI6IiY3ImY2MWY0UWM4EWYkJzNlFDZ1ETOlVmY4UGOmZzM5ICLiADNlRjN5UTYkNmNhZDZ5QjNkNzYmZzMiNWOhNjY3EmN3U2N4UjYhVmI6ISY0gzMmVDZxAzM3cTN3gzMhhDOihDZkdDNhhDO0ADO1ICLiUDMmVjM3QTNwcTZlVDOjRjMjRTZwcjMmBjNzYWNmNGNmJTY3QGOycjI6ICZxYWZ4UTO5QzNiFjMkZjYkVDO3QDMkRmYkRTOzEWOzIyes0nIRZWaJhlWuZUbihWMFlEdG12YulTbjFlSp9UajNjYrVzVhhlUxElQKNETptGbJZTSpJGcxckWC5EWhl2dpl0TKl2TpBzVZpmSXpFWOhVYpdXaJplSp9UaV1mY2h2RjZnSzkFcxAzYwp0QMl2atNGaOhlWqZFSRl2bqlESGVkVpdXaJBDbtF1ZRpmTnRDMTd2dXlVd5cVY65EWa1WOtNWUClnTn10MkZnUtJGckxWS2kUajxmWsJGckxWSzBjbJhmVtNmd0VUSvJFWkZnTGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJVzZU1Ee0knT5VERMlXRE1UM0knT6lUaPlWTyI2cKNETplUMTl2bqlUNKhEZ1Z1MipmSDxUa3dFZ2ZlMVl2bqlUd5cVYuZVbjl2dplUMkdFToJ0MaVXOyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWS3RzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiI2NiJmNjFGNlFDOhFGZycTZxQWNxkTZlJGOlhjZ2MTOiwiIhFmZ2ETYxQmZxQGMjVWZjhzYzYDZxE2YkVjMjJzN3ADZiFmY3EjNmJiOiEGN4MjZ1QWMwMzN3UzN4MTY4gjY4QGZ3QTY4gDNwgTNiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiQWMmVGO1kTO0cjYxIDZ2IGZ1gzN0ADZkJGZ0kzMhlzMis3W
request	GET https://ipinfo.io/json

Allocates read-write-execute memory (usually to unpack itself) (50 out of 90 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1431000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1acb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002090000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91caa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ced000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 18, 2021, 11:08 a.m.	process_identifier: 1768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91dd7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Aug. 18, 2021, 11:08 a.m.	total_number_of_free_bytes: 10934407168 free_bytes_available: 10934407168 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Looks up the external IP address (1 event)

domain

ipinfo.io

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 18, 2021, 11:08 a.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

94.250.250.235

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Trojan.MSIL.LightStone.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.8.Gen
FireEye	Generic.mg.aba88ae23ef00a02
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.MSIL.Basic.8.Gen
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 004bf53c1 )
Alibaba	Backdoor:MSIL/LightStone.c39d353d
K7GW	Spyware ( 004bf53c1 )
Cybereason	malicious.23ef00
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.AES
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Uztuby-9853721-0
Kaspersky	HEUR:Backdoor.MSIL.LightStone.gen
BitDefender	Trojan.MSIL.Basic.8.Gen
Avast	Win32:KeyloggerX-gen [Trj]
Ad-Aware	Trojan.MSIL.Basic.8.Gen
Sophos	Mal/SpyNoon-A
Comodo	TrojWare.Win32.Agent.gtfpl@0
DrWeb	BackDoor.QuasarNET.3
TrendMicro	TROJ_GEN.R002C0PHG21
McAfee-GW-Edition	GenericRXPF-LQ!ABA88AE23EF0
Emsisoft	Trojan.MSIL.Basic.8.Gen (B)
SentinelOne	Static AI - Malicious PE
Avira	TR/Spy.Agent.jhnah
MAX	malware (ai score=82)
Kingsoft	Win32.Hack.Undef.(kcloud)
Gridinsoft	Spy.Win32.Keylogger.oa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Trojan.MSIL.Basic.8.Gen
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Spy.C4559049
McAfee	GenericRXPF-LQ!ABA88AE23EF0
Malwarebytes	Malware.AI.1658604840
TrendMicro-HouseCall	TROJ_GEN.R002C0PHG21
Rising	Backdoor.DCRat!1.D886 (CLASSIC)
Ikarus	Trojan.MSIL.Spy
eGambit	Unsafe.AI_Score_98%
Fortinet	MSIL/Agent.DEK!tr
BitDefenderTheta	Gen:NN.ZemsilF.34088.Im0@amVy3Gni
AVG	Win32:KeyloggerX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Backdoor.LightStone.HwMAUKYA

test.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All