Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 29, 2021, 12:35 p.m.	Aug. 29, 2021, 12:38 p.m.

Size	6.5MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`06fa7a3bb6e0a0069487e229de3f98e4`
SHA256	`98767ccd2ee654cd63029feaf5ce8b2dde80d2d60970dbd6c0316030d83431fe`
CRC32	`4FFC4324`
ssdeep	`196608:e4OtNJEToVoDEhU3nSnAguNkNNMXIQen7Vo/3eOFL5:5BEOSnRNKenu/OwL5`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Chrome.exe "C:\Users\test22\AppData\Local\Temp\Chrome.exe"
180

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 29, 2021, 12:28 p.m.			0	0
IsDebuggerPresent Aug. 29, 2021, 12:28 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 29, 2021, 12:29 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000076e550 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 29, 2021, 12:29 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000076e470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 29, 2021, 12:29 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000076e470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 29, 2021, 12:30 p.m.	stacktrace: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x7723f45d K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x77253fe1 0x7fe91d90e84 0x7fe91d90dce 0x7fe91d8cf26 0x7fe91d8ca94 0x7fe91d8a428 system+0x2e80cf @ 0x7feec8080cf 0x7fe91d61388 mscorlib+0x4ef8a5 @ 0x7fef032f8a5 mscorlib+0x4ef609 @ 0x7fef032f609 mscorlib+0x4ef5c7 @ 0x7fef032f5c7 mscorlib+0x502d21 @ 0x7fef0342d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef140f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef140f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef140f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef15d6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef14b6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef14b6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef14b6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef14b6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef15d6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef15466ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521 exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8 exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d exception.instruction: mov qword ptr [r15 + rcx*8], rax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 259165 exception.address: 0x7723f45d registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 530512368 registers.r11: 514 registers.r8: 530506488 registers.r9: 530506544 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1208549376 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 29, 2021, 12:30 p.m.

stacktrace:

K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x7723f45d
K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x77253fe1
0x7fe91d90e84
0x7fe91d90dce
0x7fe91d8cf26
0x7fe91d8ca94
0x7fe91d8a428
system+0x2e80cf @ 0x7feec8080cf
0x7fe91d61388
mscorlib+0x4ef8a5 @ 0x7fef032f8a5
mscorlib+0x4ef609 @ 0x7fef032f609
mscorlib+0x4ef5c7 @ 0x7fef032f5c7
mscorlib+0x502d21 @ 0x7fef0342d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef140f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef140f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef140f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef15d6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef14b6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef14b6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef14b6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef14b6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef15d6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef15466ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521

exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8
exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d
exception.instruction: mov qword ptr [r15 + rcx*8], rax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 259165
exception.address: 0x7723f45d
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 530512368
registers.r11: 514
registers.r8: 530506488
registers.r9: 530506544
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1208549376
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000980000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1a5b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13c4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb037000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91da7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:28 p.m.	process_identifier: 180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process Chrome.exe with pid 180 crashed
__exception__ Aug. 29, 2021, 12:30 p.m.	stacktrace: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x7723f45d K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x77253fe1 0x7fe91d90e84 0x7fe91d90dce 0x7fe91d8cf26 0x7fe91d8ca94 0x7fe91d8a428 system+0x2e80cf @ 0x7feec8080cf 0x7fe91d61388 mscorlib+0x4ef8a5 @ 0x7fef032f8a5 mscorlib+0x4ef609 @ 0x7fef032f609 mscorlib+0x4ef5c7 @ 0x7fef032f5c7 mscorlib+0x502d21 @ 0x7fef0342d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef140f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef140f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef140f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef15d6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef14b6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef14b6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef14b6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef14b6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef15d6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef15466ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521 exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8 exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d exception.instruction: mov qword ptr [r15 + rcx*8], rax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 259165 exception.address: 0x7723f45d registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 530512368 registers.r11: 514 registers.r8: 530506488 registers.r9: 530506544 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1208549376 registers.r13: 0	1	0	0

Application Crash

Process Chrome.exe with pid 180 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 29, 2021, 12:30 p.m.

stacktrace:

K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x7723f45d
K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x77253fe1
0x7fe91d90e84
0x7fe91d90dce
0x7fe91d8cf26
0x7fe91d8ca94
0x7fe91d8a428
system+0x2e80cf @ 0x7feec8080cf
0x7fe91d61388
mscorlib+0x4ef8a5 @ 0x7fef032f8a5
mscorlib+0x4ef609 @ 0x7fef032f609
mscorlib+0x4ef5c7 @ 0x7fef032f5c7
mscorlib+0x502d21 @ 0x7fef0342d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef140f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef140f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef140f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef15d6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef14b6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef14b6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef14b6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef14b6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef15d6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef15466ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00666800', u'virtual_address': u'0x00002000', u'entropy': 7.99990058279964, u'name': u'.text', u'virtual_size': u'0x00666700'}

entropy

7.9999005828

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000d800', u'virtual_address': u'0x0066a000', u'entropy': 7.163970617093412, u'name': u'.rsrc', u'virtual_size': u'0x0000d604'}

entropy

7.16397061709

description

A section with a high entropy has been found

entropy

1.0

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 29, 2021, 12:30 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: cf34c48531e306f66e63e2e875de6f2ac24577c4

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 29, 2021, 12:30 p.m.	process_identifier: 264 region_size: 6463488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000338	1	0	0

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 180 manipulating memory of non-child process 264
NtUnmapViewOfSection Aug. 29, 2021, 12:30 p.m.	base_address: 0x0000000140000000 region_size: 8786425282560 process_identifier: 264 process_handle: 0x0000000000000338		-1073741799	0
NtAllocateVirtualMemory Aug. 29, 2021, 12:30 p.m.	process_identifier: 264 region_size: 6463488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000338	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 180 injected into non-child 264
WriteProcessMemory Aug. 29, 2021, 12:30 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd¼¨ð"0.b0 @ b@@@ `bx.pMb H.text-b .b `.rsrcx.`b00b@@ base_address: 0x0000000140000000 process_identifier: 264 process_handle: 0x0000000000000338	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 180 injected into non-child 264
WriteProcessMemory Aug. 29, 2021, 12:30 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd¼¨ð"0.b0 @ b@@@ `bx.pMb H.text-b .b `.rsrcx.`b00b@@ base_address: 0x0000000140000000 process_identifier: 264 process_handle: 0x0000000000000338	1	1	0

One or more non-whitelisted processes were created (1 event)

parent_process

chrome.exe

martian_process

C:\Users\test22\AppData\Local\Temp\Chrome.exe

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Cerbu.107935
FireEye	Generic.mg.06fa7a3bb6e0a006
ALYac	Gen:Variant.Cerbu.107935
ESET-NOD32	a variant of MSIL/GenKryptik.FGEO
APEX	Malicious
BitDefender	Gen:Variant.Cerbu.107935
Ad-Aware	Gen:Variant.Cerbu.107935
Emsisoft	Gen:Variant.Cerbu.107935 (B)
Ikarus	Trojan.MSIL.AgentTesla
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Cerbu.D1A59F
GData	Gen:Variant.Cerbu.107935
Cynet	Malicious (score: 100)
MAX	malware (ai score=82)
Malwarebytes	Trojan.MCrypt.MSIL.Generic
Rising	Trojan.FakeChrome!1.9C7B (CLASSIC)
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/Kryptik.ACGG!tr
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (23 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 29, 2021, 12:28 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 180	1	0
NtResumeThread Aug. 29, 2021, 12:28 p.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 180	1	0
NtResumeThread Aug. 29, 2021, 12:28 p.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 180	1	0
NtResumeThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318 suspend_count: 1 process_identifier: 180	1	0
NtResumeThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000338 suspend_count: 1 process_identifier: 180	1	0
NtGetContextThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318	1	0
NtGetContextThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318	1	0
NtResumeThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318 suspend_count: 1 process_identifier: 180	1	0
NtGetContextThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318	1	0
NtGetContextThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318	1	0
NtResumeThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000318 suspend_count: 1 process_identifier: 180	1	0
NtGetContextThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000138	1	0
NtGetContextThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000138	1	0
NtResumeThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 180	1	0
NtResumeThread Aug. 29, 2021, 12:29 p.m.	thread_handle: 0x000000000000032c suspend_count: 1 process_identifier: 180	1	0
NtResumeThread Aug. 29, 2021, 12:30 p.m.	thread_handle: 0x0000000000000260 suspend_count: 1 process_identifier: 180	1	0
NtGetContextThread Aug. 29, 2021, 12:30 p.m.	thread_handle: 0x0000000000000138	1	0
NtGetContextThread Aug. 29, 2021, 12:30 p.m.	thread_handle: 0x0000000000000138	1	0
NtResumeThread Aug. 29, 2021, 12:30 p.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 180	1	0
CreateProcessInternalW Aug. 29, 2021, 12:30 p.m.	thread_identifier: 1424 thread_handle: 0x000000000000025c process_identifier: 264 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\Chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 1 process_handle: 0x0000000000000338	1	1
NtUnmapViewOfSection Aug. 29, 2021, 12:30 p.m.	base_address: 0x0000000140000000 region_size: 8786425282560 process_identifier: 264 process_handle: 0x0000000000000338		-1073741799
NtAllocateVirtualMemory Aug. 29, 2021, 12:30 p.m.	process_identifier: 264 region_size: 6463488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000338	1	0
WriteProcessMemory Aug. 29, 2021, 12:30 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd¼¨ð"0.b0 @ b@@@ `bx.pMb H.text-b .b `.rsrcx.`b00b@@ base_address: 0x0000000140000000 process_identifier: 264 process_handle: 0x0000000000000338	1	1

Chrome.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All