popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

gfc.exe

Generic Malware HTTP Socket ScreenShot KeyLogger Internet API DNS Http API PWS .NET EXE PE File PE32 AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 29, 2021, 12:36 p.m. Aug. 29, 2021, 12:44 p.m.
Size 353.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f98399c21666ab44ffe10da4e3326546
SHA256 1ca8a6eb97e3bdc6632c0f4263c759a2a2b0b65c765bdb57437312f509452ce7
CRC32 25855436
ssdeep 6144:RqFQsTyzSawiMDgvm41cN9gL+cD815ua33Gk3DY:GnTyQ5E1cXXTua33BD
PDB Path gfc.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
37.0.10.99 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path gfc.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a70000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00462000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00495000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00497000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b41000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00057a00', u'virtual_address': u'0x00002000', u'entropy': 7.876064660297515, u'name': u'.text', u'virtual_size': u'0x00057804'} entropy 7.8760646603 description A section with a high entropy has been found
entropy 0.994326241135 description Overall entropy of this PE file is high
url http://ip-api.com/json
url https://dotbit.me/a/
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description Run a KeyLogger rule KeyLogger
description Communications over HTTP rule Network_HTTP
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 37.0.10.99
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001fc
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ˜$„¦°@@Оà\CODE°–˜ `DATAl°œ@ÀBSSÅÀ¤À.idatažÐ¤@À.reloc\à¬@PÄ@P
base_address: 0x00400000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿàO@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëqØ'ÓØ'ÓØ'ÖØ7nØ$ÓsØ$ÓsØ7sØ7ÔØ$ÓØ$nØ$ÓØ$nsØ$nØ$ÓØ7ÓsØ7ÓsØ$ÓsØ4ØIÓØ7sØ7ÖØ$nsØ$ÓsØÔØ'ØØsØXØ$ÓØ'ÖØqØ'ÖØm–"æ`žÚBZ¯!Šæ™A†þRà¨'ú²YʦäYy¸ù̖&¢÷â¡æ4`øˆð¬@ZìÕ8¢(ç<¾-ž¿©vØ¯ç ‘9n@ÆR_B´7g^ ÇÀւyu ¦áÕÀ9ÝyӐ(MZÊf÷ÛԈMS¥¨Î’öçŸV5ؖ„’Œi¿‘&c:c‡?°üZÝ¥¤†(¹¢;-7-AõÙ}[O¶Õ8َCaéŸi½áùÀ¯QmÉîP;‡cãm`ä,îXÙÃO‰`%>¡ÃxKGgÍÉýI HˆS“ß}|¶¹ðye5 q%/+/(ì2vœHaïÌ{öûô¦ÁéG,JCY¦§šÑã[VۅÇßvn¢Ž‰V:¹t0®„m=¤,úӊª¡oÆôèŸo·ÅJ{¤œ¿¼ VB1wêM«¥¶P¯‰óUÊÌ2Æk`P™vT¿ö½"Áþgk=É4ho÷ÛÏIChOoåÂp­rÔT\¸¼Ëܶòˆâ¶çCK* b]:ê› 0&äÙ4L¢Œ’àw›’@è?À_±f+™˜OP7é¸E«‹¤öܽCåÎ)U,i¨ÆÉù[U«~¿¸@›û…ÂU§]›dêõšb+ûِ‡ý/¥U…=ç\îþ ä>œ"G_ Ó¬ÎͲ½Ð/–Õ_zõ®¹U/<¾«eÞ\ųy„²b/`Ëç„V¥ütã5ƒ‹ð0λíÍ"MÝ¿ÒÐ̪–BKŠ®Ol©åq¬7ÈÚ×9ÂI´öt`>~ ăÓDQsMÑèøÛ¶„…èJ@ÊéËäù—Êç¶àKÖ)pÏbäbœh°Ã3öðÞ\K=ÃË«4•T±ô߈<xi»k…Îkå"Ÿ†­Ö&—ò;©ñŸ¡’lØ_ïGÇpÝïd#Eý\|-Öëlø¿ÉVåo<OÇ´š¬MæÑϬ JÎΠEí”k^õ‡=p‰nҟœf‡—¯uªJ*×aµÞ1ù†D*&aÄ‚@îðJà^"¥8ª}'F7ïÎjÞ¸j@ ¨UBèDC«=ÖFVÀ„`,ê1( a ³OTZº‚ ´B6EÙóžuÜa‹m¥àAß/J ±Ìa᝴KŽ˜ïèïºÊÂ {©ku*ϛœº(qo$°Ï>R3S§$§Ûìxš±ÚO~¾³Ÿ$W7>Eù")ÊØ?ê‹>ŽË҅Â}˜=VêßØò¯pnªæô¦)„ò±!ž[ÆNîñßÙ¦½ùæDI)yYi,@¤#™½,[>Šå·¤$Ç¼T7($ÇAÇAôÆApÇA¤ÆA„ÇA@ÇAhÇAlÆA,ÇA¼ÆAÇA°ÆAÆAÄÆA´°A”ÇAÇAˆÇA(ÈA\ÇAüÆA4ÇA|ÆAŒÆAìÆA ÇA<ÇA¸°AèÆA¤ÇA°°AÀÆAŒÇA¸ÆAdÆA°ÇAðÆA ÇA´ÆA(ÇAÈÇAØ°A¼°A˜ÆA ÇAÇAÇAœÆA ÆA8ÇA¬ÆAPÇA¬ÇAˆÆALÇAøÆAÌÆADÇA`ÇA¬°A ÈA¨ÇA˜ÇAÇAÈÆA€ÆAœÇA”ÆA0ÇAhÆAHÇA´ÇA
base_address: 0x0041b000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
base_address: 0x0041d000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2672
process_handle: 0x000001fc
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ˜$„¦°@@Оà\CODE°–˜ `DATAl°œ@ÀBSSÅÀ¤À.idatažÐ¤@À.reloc\à¬@PÄ@P
base_address: 0x00400000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0
Process injection Process 1116 called NtSetContextThread to modify thread in remote process 2672
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4302468
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000174
process_identifier: 2672
1 0 0
Process injection Process 1116 resumed a thread in remote process 2672
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000174
suspend_count: 1
process_identifier: 2672
1 0 0
dead_host 37.0.10.99:80
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 1116
1 0 0

CreateProcessInternalW

 thread_identifier: 1632
thread_handle: 0x00000174
process_identifier: 2672
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compILer.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compILer.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000001fc
1 1 0

NtGetContextThread

 thread_handle: 0x00000174
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001fc
1 0 0

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ˜$„¦°@@Оà\CODE°–˜ `DATAl°œ@ÀBSSÅÀ¤À.idatažÐ¤@À.reloc\à¬@PÄ@P
base_address: 0x00400000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿàO@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëqØ'ÓØ'ÓØ'ÖØ7nØ$ÓsØ$ÓsØ7sØ7ÔØ$ÓØ$nØ$ÓØ$nsØ$nØ$ÓØ7ÓsØ7ÓsØ$ÓsØ4ØIÓØ7sØ7ÖØ$nsØ$ÓsØÔØ'ØØsØXØ$ÓØ'ÖØqØ'ÖØm–"æ`žÚBZ¯!Šæ™A†þRà¨'ú²YʦäYy¸ù̖&¢÷â¡æ4`øˆð¬@ZìÕ8¢(ç<¾-ž¿©vØ¯ç ‘9n@ÆR_B´7g^ ÇÀւyu ¦áÕÀ9ÝyӐ(MZÊf÷ÛԈMS¥¨Î’öçŸV5ؖ„’Œi¿‘&c:c‡?°üZÝ¥¤†(¹¢;-7-AõÙ}[O¶Õ8َCaéŸi½áùÀ¯QmÉîP;‡cãm`ä,îXÙÃO‰`%>¡ÃxKGgÍÉýI HˆS“ß}|¶¹ðye5 q%/+/(ì2vœHaïÌ{öûô¦ÁéG,JCY¦§šÑã[VۅÇßvn¢Ž‰V:¹t0®„m=¤,úӊª¡oÆôèŸo·ÅJ{¤œ¿¼ VB1wêM«¥¶P¯‰óUÊÌ2Æk`P™vT¿ö½"Áþgk=É4ho÷ÛÏIChOoåÂp­rÔT\¸¼Ëܶòˆâ¶çCK* b]:ê› 0&äÙ4L¢Œ’àw›’@è?À_±f+™˜OP7é¸E«‹¤öܽCåÎ)U,i¨ÆÉù[U«~¿¸@›û…ÂU§]›dêõšb+ûِ‡ý/¥U…=ç\îþ ä>œ"G_ Ó¬ÎͲ½Ð/–Õ_zõ®¹U/<¾«eÞ\ųy„²b/`Ëç„V¥ütã5ƒ‹ð0λíÍ"MÝ¿ÒÐ̪–BKŠ®Ol©åq¬7ÈÚ×9ÂI´öt`>~ ăÓDQsMÑèøÛ¶„…èJ@ÊéËäù—Êç¶àKÖ)pÏbäbœh°Ã3öðÞ\K=ÃË«4•T±ô߈<xi»k…Îkå"Ÿ†­Ö&—ò;©ñŸ¡’lØ_ïGÇpÝïd#Eý\|-Öëlø¿ÉVåo<OÇ´š¬MæÑϬ JÎΠEí”k^õ‡=p‰nҟœf‡—¯uªJ*×aµÞ1ù†D*&aÄ‚@îðJà^"¥8ª}'F7ïÎjÞ¸j@ ¨UBèDC«=ÖFVÀ„`,ê1( a ³OTZº‚ ´B6EÙóžuÜa‹m¥àAß/J ±Ìa᝴KŽ˜ïèïºÊÂ {©ku*ϛœº(qo$°Ï>R3S§$§Ûìxš±ÚO~¾³Ÿ$W7>Eù")ÊØ?ê‹>ŽË҅Â}˜=VêßØò¯pnªæô¦)„ò±!ž[ÆNîñßÙ¦½ùæDI)yYi,@¤#™½,[>Šå·¤$Ç¼T7($ÇAÇAôÆApÇA¤ÆA„ÇA@ÇAhÇAlÆA,ÇA¼ÆAÇA°ÆAÆAÄÆA´°A”ÇAÇAˆÇA(ÈA\ÇAüÆA4ÇA|ÆAŒÆAìÆA ÇA<ÇA¸°AèÆA¤ÇA°°AÀÆAŒÇA¸ÆAdÆA°ÇAðÆA ÇA´ÆA(ÇAÈÇAØ°A¼°A˜ÆA ÇAÇAÇAœÆA ÆA8ÇA¬ÆAPÇA¬ÇAˆÆALÇAøÆAÌÆADÇA`ÇA¬°A ÈA¨ÇA˜ÇAÇAÈÆA€ÆAœÇA”ÆA0ÇAhÆAHÇA´ÇA
base_address: 0x0041b000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
base_address: 0x0041d000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0041e000
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2672
process_handle: 0x000001fc
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4302468
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000174
process_identifier: 2672
1 0 0

NtResumeThread

 thread_handle: 0x00000174
suspend_count: 1
process_identifier: 2672
1 0 0

NtResumeThread

 thread_handle: 0x000000e8
suspend_count: 1
process_identifier: 2672
1 0 0
Lionic Trojan.MSIL.Stealer.l!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37431822
FireEye Generic.mg.f98399c21666ab44
ALYac Trojan.GenericKD.37431822
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00568aef1 )
Alibaba Trojan:MSIL/Injector.fdc931bd
K7GW Trojan ( 00568aef1 )
Cybereason malicious.9b86f4
BitDefenderTheta Gen:NN.ZemsilF.34110.wm0@aWu6EBb
Cyren W32/MSIL_Kryptik.CBF.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Injector.UWS
TrendMicro-HouseCall TROJ_GEN.R002C0WHL21
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender Trojan.GenericKD.37431822
Avast Win32:PWSX-gen [Trj]
Tencent Msil.Trojan-spy.Stealer.Eeqt
Ad-Aware Trojan.GenericKD.37431822
Sophos Mal/Generic-S
TrendMicro TROJ_GEN.R002C0WHL21
McAfee-GW-Edition RDN/Generic PWS.y
SentinelOne Static AI - Malicious PE
Emsisoft Trojan.GenericKD.37431822 (B)
APEX Malicious
Avira HEUR/AGEN.1144304
MAX malware (ai score=81)
Antiy-AVL Trojan/Generic.ASMalwS.3479DEE
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Win32/Mamson.A!ac
GData Trojan.GenericKD.37431822
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.C4036845
McAfee RDN/Generic PWS.y
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.PasswordStealer
Ikarus Trojan.MSIL.Injector
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/Injector.UWS!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_90% (W)