Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 20, 2021, 5:07 p.m.	Aug. 20, 2021, 5:18 p.m.

Size	3.9MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`3eda59632a67aa35beb3417be7547010`
SHA256	`7868847d629d9e4466c428d9864475cdf3f3c39dfd0f92a1b6f89b5f41c0ec16`
CRC32	`445D6562`
ssdeep	`98304:qElTKuucpFQZ/kmmHgIlgbfR5A/MbtF/dIgKYdGyom:P+uT6TJkgbfOC/dqY8o`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) IsPE32 - (no description) themida_packer - themida packer

kl5.exe "C:\Users\test22\AppData\Local\Temp\kl5.exe"
2096

Name	Response	Post-Analysis Lookup
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	172.67.75.172

IP Address	Status	Action
104.26.13.31	Active	Moloch
164.124.101.2	Active	Moloch
188.124.36.242	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49166 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 20, 2021, 5:09 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 20, 2021, 5:07 p.m.			0	0
IsDebuggerPresent Aug. 20, 2021, 5:07 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 20, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071dfe0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071dfe0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071e020 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071eee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071eee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071ede0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05c6be20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05c6c0a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 20, 2021, 5:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05c6c0a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 20, 2021, 5:07 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	\xe2\x9c\x85 Qick
section	.themida
section	.boot

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Aug. 20, 2021, 5:07 p.m.	stacktrace: kl5+0x53aebb @ 0x16caebb kl5+0x53b436 @ 0x16cb436 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 cb 13 d2 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 3799432 registers.edi: 18833408 registers.eax: 3799432 registers.ebp: 3799512 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2008380459 registers.ecx: 3953590272	1
__exception__ Aug. 20, 2021, 5:07 p.m.	stacktrace: exception.instruction_r: ed e9 6b c8 00 00 f1 13 93 aa 54 77 39 32 95 fb exception.symbol: kl5+0x560927 exception.instruction: in eax, dx exception.module: kl5.exe exception.exception_code: 0xc0000096 exception.offset: 5638439 exception.address: 0x16f0927 registers.esp: 3799552 registers.edi: 22657771 registers.eax: 1750617430 registers.ebp: 18833408 registers.edx: 22614 registers.ebx: 0 registers.esi: 21874665 registers.ecx: 20	1
__exception__ Aug. 20, 2021, 5:07 p.m.	stacktrace: exception.instruction_r: ed e9 c6 19 01 00 c3 e9 48 54 ff ff ea d7 1b f8 exception.symbol: kl5+0x5646a1 exception.instruction: in eax, dx exception.module: kl5.exe exception.exception_code: 0xc0000096 exception.offset: 5654177 exception.address: 0x16f46a1 registers.esp: 3799552 registers.edi: 22657771 registers.eax: 1447909480 registers.ebp: 18833408 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 21874665 registers.ecx: 10	1
__exception__ Aug. 20, 2021, 5:09 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73351194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73222ba1 mscorlib+0x2f45a5 @ 0x724d45a5 mscorlib+0x2f74d4 @ 0x724d74d4 system+0x2504d3 @ 0x6e2004d3 system+0x250899 @ 0x6e200899 system+0x250bd6 @ 0x6e200bd6 system+0x250836 @ 0x6e200836 system+0x250707 @ 0x6e200707 system+0x24e18d @ 0x6e1fe18d system+0x24dea7 @ 0x6e1fdea7 0xe4763e 0xe4f4d4 0xe4f087 0xe4efcc 0xe4ef78 0xe4e4f9 0xe4df20 0xe46b22 0xe44fc6 0xe40076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 cb 13 d2 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 3795696 registers.edi: 0 registers.eax: 3795696 registers.ebp: 3795776 registers.edx: 0 registers.ebx: 7143072 registers.esi: 7170504 registers.ecx: 942032137	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://api.ip.sb/geoip

Performs some HTTP requests (1 event)

request

GET https://api.ip.sb/geoip

Allocates read-write-execute memory (usually to unpack itself) (50 out of 148 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75674000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a47000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a63000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a68000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76abe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a65000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2021, 5:07 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

kl5.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 20, 2021, 5:07 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (6 events)

section

{u'size_of_data': u'0x00016c00', u'virtual_address': u'0x00002000', u'entropy': 7.984555802062644, u'name': u' ', u'virtual_size': u'0x0002e000'}

entropy

7.98455580206

description