Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 7, 2021, 8:22 a.m.	Sept. 7, 2021, 8:36 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`383ebcffd99777dbc7a2d7b81f0216cd`
SHA256	`38e778a805895b5afe983e4ccfd97da4eba522f189331170f9f41cd902c05891`
CRC32	`5A8BF89A`
ssdeep	`24576:Qt0s/Yb/GvmZTw4NhIBuw88I/1orkus9oUwZwgj0kX2nhSTJ6HOD9U90U1m6+lJO:QtSZNWB788q1owrzFg4k2hSVtRnHHg/`
PDB Path	wextract.pdb
Yara	PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

eth.exe "C:\Users\test22\AppData\Local\Temp\eth.exe"
1868
- dllhost.exe dllhost.exe
  2216
- cmd.exe cmd /c cmd < Lavorato.flv
  2244
  - cmd.exe cmd
    2276
    - findstr.exe findstr /V /R "^DAGQRwZMxODGzDBMLnPGlmBKhjHNIkrmXMjWTFQybgMAasvRBRslqdztYWCFzjroLtIHsFTuIJoVMwaVQQjRUTnHaoXXekLkkDPgJOAVXlBsinsXEHPDZjg$" Tocca.flv
      2908
    - Sollevando.exe.com Sollevando.exe.com p
      3028
      - Sollevando.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com p
        2200
        
        Sollevando.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com p
        2144
    - PING.EXE ping localhost
      2420

Name	Response	Post-Analysis Lookup
jOduIfTqIUBGLbliyqGnb.jOduIfTqIUBGLbliyqGnb

IP Address	Status	Action
164.124.101.2	Active	Moloch
23.67.53.11	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 7, 2021, 8:22 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:22 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:22 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 8:22 a.m.			0	0

Command line console output was observed (37 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: Set IkoFcisvYbFRjnwTNcgqNqNrhImiMUAvPxADZYr=DESKTOP- console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: Set kwPatHBWoJkdBdjIbys=QO5QU33 console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: Set OvnYr=ping localhost console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: if %computername%==%IkoFcisvYbFRjnwTNcgqNqNrhImiMUAvPxADZYr% cmd console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: Set jiiVrkFQFkeeQjgMfUfQvmcIubwugVYPcrDeIQW=MZ console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: <nul set /p = "%jiiVrkFQFkeeQjgMfUfQvmcIubwugVYPcrDeIQW%" > Sollevando.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: findstr /V /R "^DAGQRwZMxODGzDBMLnPGlmBKhjHNIkrmXMjWTFQybgMAasvRBRslqdztYWCFzjroLtIHsFTuIJoVMwaVQQjRUTnHaoXXekLkkDPgJOAVXlBsinsXEHPDZjg$" Tocca.flv >> Sollevando.exe.com console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: copy Inganna.flv p console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: 1 file(s) copied. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: start Sollevando.exe.com p console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: %OvnYr% console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 7, 2021, 8:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Pinging test22-PC [::1] console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Reply from ::1: console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: time<1ms console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Ping statistics for ::1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Sept. 7, 2021, 8:22 a.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2021, 8:22 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	AVI
resource name	DIGEJIXAKUCIF

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 7, 2021, 8:23 a.m.	stacktrace: RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559 RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639 RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd sollevando+0x22f9f @ 0x1172f9f sollevando+0x667ec @ 0x11b67ec sollevando+0x3ba3 @ 0x1153ba3 sollevando+0x3b4d @ 0x1153b4d sollevando+0x3ba3 @ 0x1153ba3 sollevando+0x3b4d @ 0x1153b4d sollevando+0x3ad5 @ 0x1153ad5 sollevando+0xb483 @ 0x115b483 sollevando+0xc1e0 @ 0x115c1e0 sollevando+0xb311 @ 0x115b311 sollevando+0x3e518 @ 0x118e518 sollevando+0x89ad @ 0x11589ad sollevando+0x9b99 @ 0x1159b99 sollevando+0xbee2 @ 0x115bee2 sollevando+0x15348 @ 0x1165348 sollevando+0x1601f @ 0x116601f sollevando+0x27f80 @ 0x1177f80 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653 exception.instruction: jmp 0x7746e667 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 845395 exception.address: 0x7746e653 registers.esp: 7336568 registers.edi: 48607320 registers.eax: 7336584 registers.ebp: 7336688 registers.edx: 0 registers.ebx: 0 registers.esi: 7733248 registers.ecx: 2147483647	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 7, 2021, 8:23 a.m.

stacktrace:

RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559
RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639
RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd
sollevando+0x22f9f @ 0x1172f9f
sollevando+0x667ec @ 0x11b67ec
sollevando+0x3ba3 @ 0x1153ba3
sollevando+0x3b4d @ 0x1153b4d
sollevando+0x3ba3 @ 0x1153ba3
sollevando+0x3b4d @ 0x1153b4d
sollevando+0x3ad5 @ 0x1153ad5
sollevando+0xb483 @ 0x115b483
sollevando+0xc1e0 @ 0x115c1e0
sollevando+0xb311 @ 0x115b311
sollevando+0x3e518 @ 0x118e518
sollevando+0x89ad @ 0x11589ad
sollevando+0x9b99 @ 0x1159b99
sollevando+0xbee2 @ 0x115bee2
sollevando+0x15348 @ 0x1165348
sollevando+0x1601f @ 0x116601f
sollevando+0x27f80 @ 0x1177f80
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff
exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653
exception.instruction: jmp 0x7746e667
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 845395
exception.address: 0x7746e653
registers.esp: 7336568
registers.edi: 48607320
registers.eax: 7336584
registers.ebp: 7336688
registers.edx: 0
registers.ebx: 0
registers.esi: 7733248
registers.ecx: 2147483647

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 1868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 3028 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Sept. 7, 2021, 8:22 a.m.	number_of_free_clusters: 3350658 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Sept. 7, 2021, 8:22 a.m.	number_of_free_clusters: 3350658 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\MMiIBMKrYf\sZjBqqszYm.exe.com
file	C:\Users\test22\AppData\Roaming\MMiIBMKrYf\mshwuyzpOoL.js
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0014e000', u'virtual_address': u'0x0000c000', u'entropy': 7.863685266037315, u'name': u'.rsrc', u'virtual_size': u'0x0014df5e'}

entropy

7.86368526604

description

A section with a high entropy has been found

entropy

0.976251370113

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping localhost

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: e6b82984b75683f53bc68c2d95630292f64b510a

Communicates with host for which no DNS query was performed (1 event)

host

23.67.53.11

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 process_handle: 0x0000021c	1	0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sZjBqqszYm.url

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 manipulating memory of non-child process 2852
NtAllocateVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2852 region_size: 434176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x004f0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000021c	1	0	0
NtProtectVirtualMemory Sept. 7, 2021, 8:23 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 process_handle: 0x0000021c	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 injected into non-child 2852
WriteProcessMemory Sept. 7, 2021, 8:23 a.m.	buffer: ÿÿÿÿOûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 2852 process_handle: 0x0000021c	1	1	0

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Lionic	Trojan.Win32.Agent.m!c
Elastic	malicious (high confidence)
McAfee	Artemis!383EBCFFD997
Cylance	Unsafe
Cybereason	malicious.e0b693
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.CAB.AH suspicious
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	Spyware.PasswordStealer
Fortinet	W32/Malicious_Behavior.VEX
CrowdStrike	win/malicious_confidence_60% (W)

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2144 called NtSetContextThread to modify thread in remote process 2852
NtSetContextThread Sept. 7, 2021, 8:23 a.m.	registers.eip: 2000355780 registers.esp: 4913244 registers.edi: 0 registers.eax: 5324192 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 2852	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2276 resumed a thread in remote process 3028
NtResumeThread Sept. 7, 2021, 8:22 a.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 3028	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 7, 2021, 8:22 a.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 1868	1	0
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2444 thread_handle: 0x0000013c process_identifier: 2216 current_directory: filepath: track: 1 command_line: dllhost.exe filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000138	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2264 thread_handle: 0x00000138 process_identifier: 2244 current_directory: filepath: track: 1 command_line: cmd /c cmd < Lavorato.flv filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000013c	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2084 thread_handle: 0x00000088 process_identifier: 2276 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 1892 thread_handle: 0x0000008c process_identifier: 2908 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^DAGQRwZMxODGzDBMLnPGlmBKhjHNIkrmXMjWTFQybgMAasvRBRslqdztYWCFzjroLtIHsFTuIJoVMwaVQQjRUTnHaoXXekLkkDPgJOAVXlBsinsXEHPDZjg$" Tocca.flv filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2112 thread_handle: 0x00000090 process_identifier: 3028 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com track: 1 command_line: Sollevando.exe.com p filepath_r: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
NtResumeThread Sept. 7, 2021, 8:22 a.m.	thread_handle: 0x00000090 suspend_count: 0 process_identifier: 3028	1	0
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2472 thread_handle: 0x00000094 process_identifier: 2420 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping localhost filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 1316 thread_handle: 0x0000013c process_identifier: 2200 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com p filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000140	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2316 thread_handle: 0x00000138 process_identifier: 2144 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com p filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000013c	1	1
CreateProcessInternalW Sept. 7, 2021, 8:22 a.m.	thread_identifier: 2444 thread_handle: 0x00000214 process_identifier: 2852 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sollevando.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000021c	1	1
NtGetContextThread Sept. 7, 2021, 8:22 a.m.	thread_handle: 0x00000214	1	0
NtAllocateVirtualMemory Sept. 7, 2021, 8:22 a.m.	process_identifier: 2852 region_size: 434176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x004f0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000021c	1	0
WriteProcessMemory Sept. 7, 2021, 8:23 a.m.	buffer: base_address: 0x004f0000 process_identifier: 2852 process_handle: 0x0000021c	1	1
WriteProcessMemory Sept. 7, 2021, 8:23 a.m.	buffer: ÿÿÿÿOûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 2852 process_handle: 0x0000021c	1	1
NtSetContextThread Sept. 7, 2021, 8:23 a.m.	registers.eip: 2000355780 registers.esp: 4913244 registers.edi: 0 registers.eax: 5324192 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 2852	1	0

eth.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All