Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 2, 2021, 5:57 p.m.	Sept. 2, 2021, 6:08 p.m.

Size	1005.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e8b6c2c9dfbf5ccb632d59e2da690ac6`
SHA256	`45942f1e34b3d4c2b866451282878b85c26e6582f81b37b5e01437d2f8e8c32e`
CRC32	`1EE62D6A`
ssdeep	`24576:v3gjaws1jIkjpXws+olzy6TZwLOLoqZw+Jsp3OuplEih5OaYk2:vgjshn9XPVz1MOLFJgplEihkaYk2`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

368530214.exe "C:\Users\test22\AppData\Local\Temp\368530214.exe"
620
- dllhost.exe "C:\Windows\System32\dllhost.exe"
  204
- cmd.exe "C:\Windows\System32\cmd.exe" /c cmd < Salute.tmp
  1304
  - cmd.exe cmd
    804
    - findstr.exe findstr /V /R "^xgTJkMigkEcuWRLsLTAwFyeuzcjiQLxuNTllNoJvjxakbAWSTEBIHGWgjMfPmZnApfaeGAEDlrPlNQJTnzgjlMmiWVYqSTXhWSeiiUjzZXbERLBvrvsyLj$" Prendesse.tmp
      2856
    - Ape.exe.com Ape.exe.com L
      2772
      - Ape.exe.com C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com L
        1828
        
        RegAsm.exe C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        540
    - PING.EXE ping localhost
      2000

Name	Response	Post-Analysis Lookup
NNUcLOTLJm.NNUcLOTLJm

IP Address	Status	Action
164.124.101.2	Active	Moloch
77.232.36.146	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49214 -> 77.232.36.146:228	2028984	ET MALWARE Win32/1xxbot CnC Checkin	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 2, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2021, 5:58 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 2, 2021, 5:57 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:57 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:57 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:58 p.m.			0	0
IsDebuggerPresent Sept. 2, 2021, 5:58 p.m.			0	0

Command line console output was observed (37 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: Set FKskassgDIwGpqxYfyMQEEknmmevUIsYSkFnG=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: Set vfUyhgiSKsZtWUehawnTMSfVzV=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: Set mXXHKBKAEBigFRyktRakRaWoANLf=ping localhost console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: if %computername%==%FKskassgDIwGpqxYfyMQEEknmmevUIsYSkFnG% cmd console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: Set DNJcfJSZZgWMLYWhccFmGRUpxJEQTGSJFVhBiH=MZ console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: <nul set /p = "%DNJcfJSZZgWMLYWhccFmGRUpxJEQTGSJFVhBiH%" > Ape.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: findstr /V /R "^xgTJkMigkEcuWRLsLTAwFyeuzcjiQLxuNTllNoJvjxakbAWSTEBIHGWgjMfPmZnApfaeGAEDlrPlNQJTnzgjlMmiWVYqSTXhWSeiiUjzZXbERLBvrvsyLj$" Prendesse.tmp >> Ape.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: copy Cose.tmp L console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: start Ape.exe.com L console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: %mXXHKBKAEBigFRyktRakRaWoANLf% console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2021, 5:57 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000> console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Ping statistics for ::1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2021, 5:57 p.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 2, 2021, 5:57 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	AFX_DIALOG_LAYOUT
resource name	AVI
resource name	DIGEJIXAKUCIF

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (43 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 2, 2021, 5:57 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:57 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:57 p.m.	process_identifier: 1828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 1828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a42000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00900000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72612000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70beb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fca000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d1f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737a6000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729a1000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 2, 2021, 5:57 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13725110272 root_path: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\UeAfbbSQvS\vkunfbGHBKNYQ.js
file	C:\Users\test22\AppData\Roaming\UeAfbbSQvS\SprCNXIuIz.exe.com
file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c cmd < Salute.tmp

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com

Executes one or more WMI queries (3 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_Processor
wmi	SELECT Caption FROM Win32_OperatingSystem

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 2, 2021, 5:57 p.m.	show_type: 0 filepath_r: cmd parameters: /c cmd < Salute.tmp filepath: cmd	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: aaa14a72734224afe48634b3a714509f3e23d436

Communicates with host for which no DNS query was performed (1 event)

host

77.232.36.146

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000220	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 2, 2021, 5:58 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

RegAsm.exe tried to sleep 2728397 seconds, actually delayed analysis time by 2728397 seconds

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SprCNXIuIz.url

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 2, 2021, 5:58 p.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 540 process_handle: 0x00000220	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1828 called NtSetContextThread to modify thread in remote process 540
NtSetContextThread Sept. 2, 2021, 5:58 p.m.	registers.eip: 2000355780 registers.esp: 2817032 registers.edi: 0 registers.eax: 856046 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 540	1	0	0

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (5 events)

Time & API	Arguments	Status	Return
CryptHashData Sept. 2, 2021, 5:58 p.m.	buffer: Intel(R) Core(TM) i5-8400 CPU @ 2.80GHztest22?? VGA ??? ???TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 1test22-PC hash_handle: 0x00577b58 flags: 0	1	1
CryptHashData Sept. 2, 2021, 5:58 p.m.	buffer: Intel(R) Core(TM) i5-8400 CPU @ 2.80GHztest22?? VGA ??? ???TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 1test22-PC hash_handle: 0x00577b58 flags: 0	1	1
CryptHashData Sept. 2, 2021, 5:58 p.m.	buffer: Intel(R) Core(TM) i5-8400 CPU @ 2.80GHztest22?? VGA ??? ???TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 1test22-PC hash_handle: 0x00577b58 flags: 0	1	1
CryptHashData Sept. 2, 2021, 5:58 p.m.	buffer: Intel(R) Core(TM) i5-8400 CPU @ 2.80GHztest22?? VGA ??? ???TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 1test22-PC hash_handle: 0x00577b58 flags: 0	1	1
CryptHashData Sept. 2, 2021, 5:58 p.m.	buffer: Intel(R) Core(TM) i5-8400 CPU @ 2.80GHztest22?? VGA ??? ???TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 1test22-PC hash_handle: 0x00577b58 flags: 0	1	1

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 804 resumed a thread in remote process 2772
NtResumeThread Sept. 2, 2021, 5:57 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 2772	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
McAfee	Artemis!E8B6C2C9DFBF
K7AntiVirus	Trojan ( 005819561 )
K7GW	Trojan ( 005819561 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Agent.ADKO
APEX	Malicious
Avast	Win32:Trojan-gen
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Agent.myudin
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Sophos	Mal/Generic-S
Paloalto	generic.ml
Jiangmin	Trojan.Gamaredon.i
Avira	TR/Agent.iqbxp
Antiy-AVL	Trojan/Generic.ASMalwS.30F14FE
Gridinsoft	Trojan.Win32.Packed.oa!s1
Microsoft	Trojan:Win32/Tnega!ml
AhnLab-V3	Trojan/Win.Trojan-gen.C4616843
Cylance	Unsafe
Tencent	Malware.Win32.Gencirc.10cebfc5
Yandex	Trojan.GenAsa!/mh2sPgQKco
Fortinet	PossibleThreat.PALLAS.H
AVG	Win32:Trojan-gen

Executed a process and injected code into it, probably while unpacking (25 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 1972 thread_handle: 0x00000270 process_identifier: 204 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\dllhost.exe track: 1 command_line: "C:\Windows\System32\dllhost.exe" filepath_r: C:\Windows\System32\dllhost.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000278	1	1
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 1444 thread_handle: 0x00000280 process_identifier: 1304 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c cmd < Salute.tmp filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634176 (CREATE_DEFAULT_ERROR_MODE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000298	1	1
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 1460 thread_handle: 0x00000088 process_identifier: 804 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 656 thread_handle: 0x0000008c process_identifier: 2856 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^xgTJkMigkEcuWRLsLTAwFyeuzcjiQLxuNTllNoJvjxakbAWSTEBIHGWgjMfPmZnApfaeGAEDlrPlNQJTnzgjlMmiWVYqSTXhWSeiiUjzZXbERLBvrvsyLj$" Prendesse.tmp filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 1812 thread_handle: 0x00000090 process_identifier: 2772 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com track: 1 command_line: Ape.exe.com L filepath_r: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread Sept. 2, 2021, 5:57 p.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 2772	1	0
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 2748 thread_handle: 0x00000094 process_identifier: 2000 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping localhost filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW Sept. 2, 2021, 5:57 p.m.	thread_identifier: 2412 thread_handle: 0x0000013c process_identifier: 1828 current_directory: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000 filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\Ape.exe.com L filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000140	1	1
CreateProcessInternalW Sept. 2, 2021, 5:58 p.m.	thread_identifier: 2660 thread_handle: 0x00000214 process_identifier: 540 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000220	1	1
NtGetContextThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x00000214	1	0
NtAllocateVirtualMemory Sept. 2, 2021, 5:58 p.m.	process_identifier: 540 region_size: 90112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000220	1	0
WriteProcessMemory Sept. 2, 2021, 5:58 p.m.	buffer: base_address: 0x000c0000 process_identifier: 540 process_handle: 0x00000220	1	1
WriteProcessMemory Sept. 2, 2021, 5:58 p.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 540 process_handle: 0x00000220	1	1
NtSetContextThread Sept. 2, 2021, 5:58 p.m.	registers.eip: 2000355780 registers.esp: 2817032 registers.edi: 0 registers.eax: 856046 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x00000178 suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x000001f0 suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x00000420 suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x0000043c suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x00000460 suspend_count: 1 process_identifier: 540	1	0
NtResumeThread Sept. 2, 2021, 5:58 p.m.	thread_handle: 0x00000460 suspend_count: 1 process_identifier: 540	1	0

368530214.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All