Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 9, 2021, 9 a.m.	Sept. 9, 2021, 9:02 a.m.

Size	99.0KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`7411bd9a32735dfdeee38ee1f6629a7f`
SHA256	`18af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511`
CRC32	`66B3B975`
ssdeep	`1536:jJZJldymYVraPfFIdeD4P2ZDNjHSSu9tK66hdwY3VtqRsWEcdWEs8nBsRVuwtEBg:jNFp2kDzDZySmI6UwyzqRWZDNtEB6c/`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

abdcffc9bcf6d5c536c89f879e95ed21.exe "C:\Users\test22\AppData\Local\Temp\abdcffc9bcf6d5c536c89f879e95ed21.exe"
2020
- abdcffc9bcf6d5c536c89f879e95ed21.exe "C:\Users\test22\AppData\Local\Temp\abdcffc9bcf6d5c536c89f879e95ed21.exe" -u
  1628
rundll32.exe rundll32.exe "C:\Users\test22\AppData\Local\Temp\sqlite.dll",global
808
- rundll32.exe rundll32.exe "C:\Users\test22\AppData\Local\Temp\sqlite.dll",global
  1792

Name	Response	Post-Analysis Lookup
b.upstloans.net	A 104.21.31.210 A 172.67.179.248	172.67.179.248
google.vrthcobj.com		34.97.69.225
a.goatgame.co	A 172.67.146.70 A 104.21.79.144	104.21.79.144
google.vrthcobj.com	A 34.97.69.225	34.97.69.225
crl.identrust.com	CNAME a1952.dscq.akamai.net A 182.162.106.42 CNAME identrust.edgesuite.net A 182.162.106.26	23.43.165.66
x1.c.lencr.org	CNAME crl.root-x1.letsencrypt.org.edgekey.net CNAME e8652.dscx.akamaiedge.net A 104.74.211.103	104.76.75.146
a.upstloans.net	A 104.21.31.210 A 172.67.179.248	172.67.179.248
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
104.21.31.210	Active	Moloch
104.21.79.144	Active	Moloch
104.74.211.103	Active	Moloch
164.124.101.2	Active	Moloch
182.162.106.26	Active	Moloch
208.95.112.1	Active	Moloch
34.97.69.225	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49164 -> 104.21.79.144:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49170 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49170 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49170 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49170 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49164 104.21.79.144:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	2f:1b:f4:da:ad:da:2a:22:ea:dc:26:f0:35:83:25:0d:5d:29:4d:fb
TLSv1 192.168.56.102:49176 104.21.31.210:443	None	None	None
TLSv1 192.168.56.102:49171 104.21.31.210:443	C=US, O=Let's Encrypt, CN=R3	CN=*.upstloans.net	12:ed:3c:4a:ff:c2:a1:8d:83:7a:48:18:92:32:52:dc:a3:6f:83:f7
TLSv1 192.168.56.102:49174 104.21.31.210:443	C=US, O=Let's Encrypt, CN=R3	CN=*.upstloans.net	12:ed:3c:4a:ff:c2:a1:8d:83:7a:48:18:92:32:52:dc:a3:6f:83:f7
TLSv1 192.168.56.102:49175 104.21.31.210:443	C=US, O=Let's Encrypt, CN=R3	CN=*.upstloans.net	12:ed:3c:4a:ff:c2:a1:8d:83:7a:48:18:92:32:52:dc:a3:6f:83:f7

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 9, 2021, 9 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 9, 2021, 9 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 9, 2021, 9 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header				suspicious_request	POST https://a.upstloans.net/report7.4.php
suspicious_features	POST method with no referer header				suspicious_request	POST https://b.upstloans.net/report7.4.php

Performs some HTTP requests (7 events)

request	GET http://ip-api.com/json/?fields=8198
request	GET http://crl.identrust.com/DSTROOTCAX3CRL.crl
request	GET http://x1.c.lencr.org/
request	GET https://a.goatgame.co/userf/dat/2201/sqlite.dat
request	GET https://a.goatgame.co/userf/dat/sqlite.dll
request	POST https://a.upstloans.net/report7.4.php
request	POST https://b.upstloans.net/report7.4.php

Sends data using the HTTP POST Method (2 events)

request	POST https://a.upstloans.net/report7.4.php
request	POST https://b.upstloans.net/report7.4.php

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74be3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f83000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73651000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 region_size: 1052672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 region_size: 389120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2021, 9 a.m.	process_identifier: 1792 region_size: 315392 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0001b0a0

size

0x000002b0

Looks up the external IP address (1 event)

domain

ip-api.com

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 9, 2021, 9 a.m.	snapshot_handle: 0x00000120 process_name: pw.exe process_identifier: 888	1	1
Process32NextW Sept. 9, 2021, 9 a.m.	snapshot_handle: 0x00000120 process_name: sppsvc.exe process_identifier: 2588	1	1
Process32NextW Sept. 9, 2021, 9 a.m.	snapshot_handle: 0x00000120 process_name: WmiPrvSE.exe process_identifier: 2844	1	1
Process32NextW Sept. 9, 2021, 9 a.m.	snapshot_handle: 0x00000120 process_name: rundll32.exe process_identifier: 808	1	1

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExW Sept. 9, 2021, 9 a.m.	key_handle: 0x00000124 regkey_r: 1 reg_type: 3 (REG_BINARY) value: ÁÕx4XÁåH<PÁýPwËoÜØ_µHÅµ¾HÅ¼«HcáA@Å±4^¯fZÅÊC@K°h·?ËjètM=ãK£¹áü÷¶Ãc~¹²$ ?xÃ{aLÇs°Íh$ÏüsEø½ç@tPAÊ]ù¸003ú6)Ã{¸ÍE´H±Æ·¹ÎMÅÉ`tÃ]ÁÍ`dÁÂGÅh»ÿ^ßptÃE&÷3áù¸HÃE¾(Ã×x\|ÃçHD(ÃÿPL ËGôqÃ çÁÕx<Åh,]ÅáHñÉm,Àe-Ã!E`3èâ.DDHîçLLLHÃÛHTÇÙB]ÆÉr}ÈEÏû~I#\|·@NRÆPÉ7¼BÉÌüp:ò2z½ÃÎòÿ)øTK¸ÀL½ThÃÞêúÎRÖ±¼ÃÄº[B!ãË·=ÊhêtªÀ4³pºÊúQiJó±x`AnóÁÏXNÛÅûrEN±½J¶<ÇÓyc¤c1~"yò8zBaj ;»¾ÊÊe©3vJÃÏ¸£@ÊÂUUJËCØJÓrêÞ7µÎ&JÂsëß!¦Aø.@\|2~oNÇH<>Î±~¦$ËÍÏJKP{û´®ÉÌ@p·OÁN±¾I¶?Âû¹y`§eXXJ>==>§"ÍÅ K¸ûòÁ#ÀL¼eIOfïÕBE´kWÅÀL[ß±¿À Æ¹X@#ãÛ·>Ëiët^õ;¡Ñï§±·ÅÀ8/]÷©¿ìOÃI)é1óÃ¸ÔðHÉEÀ_ËoÄÀûí·ËkáAËGìëÁÕx,]ËoÜxÃrrQcõ;Q!ïFáü÷¶ÁÍ`À6#F²$ ?xÃc9,F;ÂÁ ¬LÇkTAFð¾õz4ÇsGRFR¹Á ¤èu`·ÁÍ`lÇckx»3t4ó)¼V¸õZf_>s~²½ f_>r+KtÅ Hsâ«§T½nEt}½<u¶{¸ fãÁz(bÃA²z(vÄHðf_}zaÑàK¸óz8JÁ¹ úBZÉÜPLÈE´VkÄÊE:øÌþ¶JÑËBéarë¬ÔúÏÇr}~ñÅß¢»Ïßjjgá¾5FÒÊI¶µoù´'zó»OqÀAÊJxrCIÊÈGENHC;áÑÂÀÖsiÌÄ¶üËCJ¶ÚáêNLÏZÊkét¾ojn_¾øù@Aù¸00AÊYáú6ÃSÍEÏ_%»ÏÏzjÃ\ÃC¾(vúN¸^"wr8u:Èäh¸rÅÁÊJÚE´VgÎJÖEÀE´aTÊZÒHÅKKÔ¾(vú¯'Bî]WR8t²ÇçHõZf_:wweïK+GèEHKøÂ>sv7°EÏ D}¶;´HÅOÇPgto»NÏÉFEBË¼ý½AÊKËkà@9¤/³UE¾EwÁÇBMJ¸¶¸¹ððAN¸w¦Eâx¹ f]ú´dKÀaðJÇOMHÊBÃOfÿ¡¹vúBÉFLKÓ[NÏÉFEBË½ÖïÇ/¬EÏHÅ¹7EÏÅBHÏå~XKÈÏ{¼Oè§Oð«pmvúÇk¨ÍEÏü¾Êb¤t7z3ÂEÎr±ÃXÂGÍW«\| ¸e9ìOËAÀJKÐ,k°¤EvúÍEÏÄ½´Â+g·:Çv´&äHÆ;{u0\|Ê÷ËEÒEµôÍÇ/¬LÇçHdÏ' EÀE´S¬#¤E´iCðâ¿«ÇOÇH+éB¾ÁÖouvóKôW`Ã@KøºÌýq])(REµhXvóóáÃ@4(äáù¸HÃ@¾+=OZtMÃ×xT8ËGôqPTÌXîè qÍ 666Ûyçpé âÇù:`äÔ¡ð"+¬¨¤ðV #ëCËN ÊD@GLZ`` (>TU%'à!@ÃÆ[M07 àÐ±80%½ ÊÄÐ6êÝÌÛrª/îççÿ}õtL) `¥Çú^¡'çÔ¢bÁ±»Ø@CIÂÁ¡Ðv:úÁSÁv÷ ÉÇÀúøú:Z DBÇÏÕ÷å k»ÙÜÞËÒå¹õüÞÈRÀTû{à³ÇKÃäÿoooSSXH éõ½¯ÌÌHËoì(Àï3úÉEvóóáÁ]I·¨ÀÀÚÀè¸Ý@FÆFNXúR#Gì á7r¤Ëÿó©â5¸®'=øÀÃÖbhâá,Ìà3Åö"4öà!áÃ#ãÀfï¾äÀÃ èóûCu80xÅáHhÃ #y_"öÁ ÅE À3SHcË¨ÅÙp0»»b&¹ê®¾E[)sZdh):òø°¹QÃÆMÈ{þ%t;¥¢£ýuMYòàÍ¡ô 8Ùèø[¬··äê»Ëjîï7Æñ©ÄôÏc[õ¤QéKéªè¸¸ã×`MüöÚóç7å6ááú6êQ×&uÈilJÕE´d°¼ÀJBIÀúÄU¨¹¼E@håÌ_òiÈÃ¢<ým©Xê?9Ä@ÑELwvÁ\x,@ÁåH4HÁýP<PÁõl4av((hÅA[HÃRÁPÁJ±ê.1Õá²æA´3ÞKàìÑÅö[xÁâ;0`8µÍ5wdï"+Z<æØ+(Cà§Ï½ÐáIÁÎÿPLYXåT%!6++à Á!D'}bwHËmït´ÃdHX4ßÿPd@HÃ÷XlÁ KÁH`ïD ®!@!`ÇD2 @AÆE±1ÇDæbZ_ ! '_ÈÀX×x0) aTÉ!Ãv¶þQÃñÄ¥ó5Âu\|·"¸!IÃD':XLAY"æÑiEH<9xß±tQÖ<I Ãë9dP\@Õ!ÈÂyÏê8×[¿Àk!\\| Ag¬~q<$Vù°_¿ó4ÇóÕÄó«z3XX00ÀÓI5ÿIï·;:¡º tNÊñyêó§s1ãø~çïü´±µ&uü41 0Fj{BL÷P35 µËyàbHÂP isbr0Ñéìt¼YGPïêÒuÀE·ê¿.PB+y]\±çö¿·Ú3 !ÞäKj¨9®MÊ{¸ÌaZ£flñ"r´Dµe»¯gX$0Ìzs8Ç+ãKµ!Pu%<tÃ^/£HÇëÈÔ$ 91RozSm0Ãßôs»êî«}¥+hµÊ$ûÃÅÍ÷vÀkGx£Uh)Æ!¾Ñê¼¹EµsMß¤¤ìHD(ÅÉ`DP°Ä`dÁ1?!v`Á;ÇDnñgoká<G4 µL//h4HÁ ¶Eô[z³@19ÅÂwâÂÄ¤Ã¬ê¯´r6P³µtRò®øÆ¶u[xtÅÒ~AgsPßG)[@öæÈû º ½uÃÌOAI@ÃápSRTÃ[ÃÄ ¥ÈÆ]uÅÖôóÄH+4o\|ÉËv³2°QCÄ§ê`tº3Ä ãSÅÆ@j[3_ÇT@#/ÌA¶¿Q\íáõãbsáç#ÁâO\|³Ò5ÔªÐzØBÛ~pKù@/$Oh((ëãj°¢¨¿â@ívÅpPS+ÈónH{ê¢#RgêêÇQ¢²ÔP6ò+º¡âòi[ôû´îççi<Íùqr`Òò¶ÃTrOíAfË+¬,{$HØ)KjÞF8o}µ¡@\oÌ2Ë ÙAÅÁ`r/ê\|ôÕÏÕ\|§»}Ãu71FJÙ ÜF'-lÂ0ôïizìÉ~³YÊC+JÕÿ¦QÆ»6 pE´ùêTJªÐføêç²EIDTK(¥þ¿ÔG@K7@ÇWÀâsÉÀúSwÆñjÙà¥-óÂõ¸£è{¼ÇiâHÃb`>8¹-EÍzðAÈÊkkÓM/rQ¶¯À[SEÄòkUÈxtÍ+ìBGù¨±¦ta.9VHÃÎu\|Ç@Ä·úemÎMÁD`qÂ_Åëâvô÷ñ0÷Æ23±õÕýªE`xòÁÎu`ZÁëáBÃ@#T#ñ8xD,Ü®l:i4E8¨ÔL(^N`a¤¦¢Ú]L©¦:â¸~tEQ·gB°}ðY¨8¬TÿÛËjÀrMLÖáàÉÏ¹gw_¹Î¨¦G OÁ1+Sº¶uÿ$S%î9j<$§Þ¶+ºÀcä<Í´6óãÅÌe%H@ÍL½yÏÜW9ûZ8ãZF$=JIÅh,[ÕHÁ"çDê¿x MÅí(¸¹A"{ü¤T´Å²³;Eæ+ (ÃC{òn¼<4D¹ó5J;kàEwß¥ÃJñtÌ$Fs Lh£CÂ»ðøµæùî[2zù@5q7ó+î´µÅáýÉÑ3aØ@Uv×Æ)O4x<¤«ë¢_,%l$bDoêû³{QÊK%p?ûÐs¼ÏIÅç regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{LJU50KX1-5I52-VT6Q-WSWM-U2Z9XL21ZV61}\1	1	0	0

Uses WMI to create a new process (1 event)

Time & API	Arguments	Status	Return	Repeated
IWbemServices_ExecMethod Sept. 9, 2021, 9 a.m.	inargs.CurrentDirectory: None inargs.CommandLine: rundll32.exe "C:\Users\test22\AppData\Local\Temp\sqlite.dll",global inargs.ProcessStartupInformation: None outargs.ProcessId: 808 outargs.ReturnValue: 0 flags: 0 method: Create class: Win32_Process	1	0	0

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

MicroWorld-eScan	Trojan.GenericKD.46899149
FireEye	Trojan.GenericKD.46899149
McAfee	GenericRXAA-AA!7411BD9A3273
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanDownloader:Win32/Injector.b38a2658
K7GW	Riskware ( 0040eff71 )
Cyren	W32/Trojan.WUMX-2818
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FVM
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Injector.lp
BitDefender	Trojan.GenericKD.46899149
Avast	Win32:MalwareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.11cbe747
Ad-Aware	Trojan.GenericKD.46899149
Sophos	Generic ML PUA (PUA)
Comodo	Malware@#21hkfnn4u4u4t
DrWeb	Trojan.Inject4.16099
Zillya	Trojan.Injector.Win32.1065746
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.46899149 (B)
Ikarus	Trojan.SuspectCRC
Jiangmin	Trojan.Injector.dx
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.wider
Antiy-AVL	Trojan/Generic.ASMalwS.3482E1C
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Sabsik.FL.A!ml
ViRobot	Trojan.Win32.Z.Ser.101376
GData	Win32.Trojan.PSE.1HNXF2S
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4617150
ALYac	Trojan.GenericKD.46899149
MAX	malware (ai score=84)
VBA32	TrojanDownloader.Zenlod
Malwarebytes	Backdoor.Farfli
Fortinet	W32/PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A

abdcffc9bcf6d5c536c89f879e95ed21.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All