popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

fish.exe

Generic Malware UPX Admin Tool (Sysinternals etc ...) DNS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2021, 9:38 a.m. Aug. 19, 2021, 9:48 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3306d43a83c6d6c58cee03e51617ee21
SHA256 95180da7cbc5ead1e82d68aa9e529390cf5f2b7e9b647dbc4bee8c42952e27b9
CRC32 B6CEF49C
ssdeep 24576:ug7qA7Q9gEvGnq5FCyPYFECac9CtJdyrhEv269GAMePmXgJ1i2:u1X9RKq5F/AFECOJArhC9TMuJ1t
Yara
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
newmeforever.3utilities.com
A 79.134.225.25
79.134.225.25
newmeforever12.3utilities.com
IP Address Status Action
164.124.101.2 Active Moloch
79.134.225.25 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:57460 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:65329 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63194 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61794 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:56977 -> 164.124.101.2:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:56887 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:50851 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:60751 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61479 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62430 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:59369 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:54056 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55629 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55450 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62902 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:62362 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:61673 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:55667 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:60820 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63951 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:54657 -> 8.8.4.4:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.101:63983 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Updates\krhUjKi" has successfully been created.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
domain newmeforever.3utilities.com
domain newmeforever12.3utilities.com
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72831000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72832000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00442000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00443000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00444000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00445000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00446000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00457000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00456000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00462000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00447000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00448000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00449000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00970000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00971000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00972000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00973000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f112000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef60000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00475000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00974000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00975000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00976000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00977000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00978000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00979000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0097a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0097b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0097c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\krhUjKi" /XML "C:\Users\test22\AppData\Local\Temp\tmp999.tmp"
cmdline schtasks.exe /Create /TN "Updates\krhUjKi" /XML "C:\Users\test22\AppData\Local\Temp\tmp999.tmp"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /Create /TN "Updates\krhUjKi" /XML "C:\Users\test22\AppData\Local\Temp\tmp999.tmp"
filepath: schtasks.exe
1 1 0
section {u'size_of_data': u'0x00137e00', u'virtual_address': u'0x00002000', u'entropy': 7.582041322932248, u'name': u'.text', u'virtual_size': u'0x00137cb4'} entropy 7.58204132293 description A section with a high entropy has been found
entropy 0.998 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\krhUjKi" /XML "C:\Users\test22\AppData\Local\Temp\tmp999.tmp"
cmdline schtasks.exe /Create /TN "Updates\krhUjKi" /XML "C:\Users\test22\AppData\Local\Temp\tmp999.tmp"
buffer Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9
buffer Buffer with sha1: 4380fb6de89a7776d52214359ce213d24a2239ad
buffer Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer Buffer with sha1: c1ef2ca62189121934d1a7944ef1bdc1aa319877
buffer Buffer with sha1: 063fb8b27c0872c54bff35e2b76d8f522e13f8b4
buffer Buffer with sha1: 925c5236c59dd8f3efea4b3e091ef735b405a880
buffer Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer Buffer with sha1: dcdec0ea839844e977c1151d2eeedbb0788a34b1
buffer Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: efa4948abb218e47d809bedd1aff08cfb76d40e1
buffer Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3036
region_size: 573440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000324
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description RegSvcs.exe tried to sleep 5456577 seconds, actually delayed analysis time by 5456577 seconds
file C:\Users\test22\AppData\Local\Temp\tmp999.tmp
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Ȉ’ç @ À8çW ø…  H.text˜Ç È `.reloc Ê@B.rsrcø… †Ì@@
base_address: 0x00400000
process_identifier: 3036
process_handle: 0x00000324
1 1 0

WriteProcessMemory

 buffer: à ”7
base_address: 0x00420000
process_identifier: 3036
process_handle: 0x00000324
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3036
process_handle: 0x00000324
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Ȉ’ç @ À8çW ø…  H.text˜Ç È `.reloc Ê@B.rsrcø… †Ì@@
base_address: 0x00400000
process_identifier: 3036
process_handle: 0x00000324
1 1 0
Process injection Process 2948 called NtSetContextThread to modify thread in remote process 3036
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000374
process_identifier: 3036
1 0 0
file C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe:Zone.Identifier
Process injection Process 2948 resumed a thread in remote process 3036
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000374
suspend_count: 1
process_identifier: 3036
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x0000015c
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x00000250
suspend_count: 1
process_identifier: 2948
1 0 0

CreateProcessInternalW

 thread_identifier: 2908
thread_handle: 0x0000035c
process_identifier: 2200
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\krhUjKi" /XML "C:\Users\test22\AppData\Local\Temp\tmp999.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000364
1 1 0

CreateProcessInternalW

 thread_identifier: 2892
thread_handle: 0x00000374
process_identifier: 3036
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000324
1 1 0

NtGetContextThread

 thread_handle: 0x00000374
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3036
region_size: 573440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000324
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Ȉ’ç @ À8çW ø…  H.text˜Ç È `.reloc Ê@B.rsrcø… †Ì@@
base_address: 0x00400000
process_identifier: 3036
process_handle: 0x00000324
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 3036
process_handle: 0x00000324
1 1 0

WriteProcessMemory

 buffer: à ”7
base_address: 0x00420000
process_identifier: 3036
process_handle: 0x00000324
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00422000
process_identifier: 3036
process_handle: 0x00000324
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3036
process_handle: 0x00000324
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000374
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000374
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000388
suspend_count: 1
process_identifier: 2948
1 0 0

NtGetContextThread

 thread_handle: 0x00000388
1 0 0

NtGetContextThread

 thread_handle: 0x00000388
1 0 0

NtResumeThread

 thread_handle: 0x00000388
suspend_count: 1
process_identifier: 2948
1 0 0

NtResumeThread

 thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000160
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000208
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000268
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000344
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000358
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000370
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x000003a0
suspend_count: 1
process_identifier: 3036
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.582045
McAfee AgentTesla-FCTJ!3306D43A83C6
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.039425
Arcabit Trojan.Bulz.D8E19D
Cyren W32/MSIL_Troj.BJP.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/Kryptik.ACMR
APEX Malicious
Paloalto generic.ml
Kaspersky VHO:Trojan.MSIL.Crypt.gen
BitDefender Gen:Variant.Bulz.582045
Ad-Aware Gen:Variant.Bulz.582045
Emsisoft Gen:Variant.Bulz.582045 (B)
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
FireEye Generic.mg.3306d43a83c6d6c5
eGambit Unsafe.AI_Score_99%
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Gen:Variant.Bulz.582045
Cynet Malicious (score: 100)
ALYac Gen:Variant.Bulz.582045
MAX malware (ai score=83)
Malwarebytes MachineLearning/Anomalous.96%
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/AgentTesla.QKZL!tr
BitDefenderTheta Gen:NN.ZemsilF.34088.on0@a4UkWLl
CrowdStrike win/malicious_confidence_80% (D)
dead_host 192.168.56.101:49213
dead_host 192.168.56.101:49212
dead_host 79.134.225.25:83
dead_host 192.168.56.101:49211
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49207
dead_host 192.168.56.101:49209
dead_host 192.168.56.101:49208
dead_host 192.168.56.101:49215
dead_host 192.168.56.101:49214