Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 9, 2021, 4:29 p.m.	Sept. 9, 2021, 4:31 p.m.

Size	4.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b9424401181e75b5c4b5d418860d864e`
SHA256	`d9749ec5118c79bf79a41612df04940ca9ce6309b0c0c865d037647f3cf3c345`
CRC32	`9EE489F7`
ssdeep	`98304:5tZLj/b/zV8XCgN0a6oIYlKe4Wr9YX3/ORzj4rgrPGAR3:5tVjz/Z8XCE5I44Wr9W2xhrPp`
Yara	PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
1896
- tintie.exe "C:\Users\test22\AppData\Local\Temp\chital\tintie.exe"
  2428
  - cmd.exe "cmd" /c cmd < Verse.xltx
    2200
    - cmd.exe cmd
      2532
      - findstr.exe findstr /V /R "^HXjglPdFADCPqJRTbaMKCmYsgOXSoTrePEJUzzLbWEjwJmhLfNrHxKviZVZvSbbGAAZvZWAtGfNXjXHOAkDxPvIyiCVnzgFniGBpAQMahZwtWmUehkVGUeQrSUgbqwKsKgPGcngJmliPxDoIHTlo$" Hai.xltx
        1808
      - Cubi.exe.com Cubi.exe.com g
        2064
        
        Cubi.exe.com C:\Users\test22\AppData\Roaming\Cubi.exe.com g
        2748
        
        Cubi.exe.com C:\Users\test22\AppData\Roaming\Cubi.exe.com
        2252
      - PING.EXE ping TEST22-PC
        260
- cousin.exe "C:\Users\test22\AppData\Local\Temp\chital\cousin.exe"
  1836

Name	Response	Post-Analysis Lookup
JhGOXkuJVqJfLGQiRCYLKKR.JhGOXkuJVqJfLGQiRCYLKKR

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 9, 2021, 4:29 p.m.			0	0
IsDebuggerPresent Sept. 9, 2021, 4:29 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 9, 2021, 4:29 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd6da49d cousin+0x4de204 @ 0x13fbee204 cousin+0x4f9705 @ 0x13fc09705 HeapWalk-0x1ce0 kernel32+0x0 @ 0x76e40000 0x13fac8 0x13fac8 0x13fac8 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 42141 exception.address: 0x7fefd6da49d registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1
__exception__ Sept. 9, 2021, 4:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1307584 registers.rsi: 1999256272 registers.r10: 0 registers.rbx: 0 registers.rsp: 1309392 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1309416 registers.rdi: 5359534080 registers.rax: 1999912563 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73721000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72764000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72811000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d22000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077210000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\chital\cousin.exe
file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\nsv6442.tmp\UAC.dll
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Users\test22\AppData\Local\Temp\nsw67EB.tmp\nsExec.dll
file	C:\Users\test22\AppData\Local\Temp\chital\tintie.exe
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Roaming\Cubi.exe.com

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\chital\tintie.exe
file	C:\Users\test22\AppData\Local\Temp\nsv6442.tmp\UAC.dll

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping TEST22-PC

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: c47cda967bbd6942131e9560504fc2b43d0b7e87

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 159744 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x0000022c	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\AVG

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 9, 2021, 4:29 p.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 2252 process_handle: 0x0000022c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2748 called NtSetContextThread to modify thread in remote process 2252
NtSetContextThread Sept. 9, 2021, 4:29 p.m.	registers.eip: 2000355780 registers.esp: 8191092 registers.edi: 0 registers.eax: 809246 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 2252	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2532 resumed a thread in remote process 2064
NtResumeThread Sept. 9, 2021, 4:29 p.m.	thread_handle: 0x00000138 suspend_count: 0 process_identifier: 2064	1	0	0

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ Sept. 9, 2021, 4:29 p.m.	tid: 3016 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2852 thread_handle: 0x0000022c process_identifier: 2428 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\chital\tintie.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000230	1	1
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 3016 thread_handle: 0x00000230 process_identifier: 1836 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\chital\cousin.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000022c	1	1
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2724 thread_handle: 0x00000220 process_identifier: 2200 current_directory: filepath: track: 1 command_line: "cmd" /c cmd < Verse.xltx filepath_r: stack_pivoted: 0 creation_flags: 16 (CREATE_NEW_CONSOLE) inherit_handles: 1 process_handle: 0x00000224	1	1
NtGetContextThread Sept. 9, 2021, 4:29 p.m.	thread_handle: 0xfffffffffffffffe	1	0
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2324 thread_handle: 0x00000130 process_identifier: 2532 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000134	1	1
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2408 thread_handle: 0x00000134 process_identifier: 1808 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^HXjglPdFADCPqJRTbaMKCmYsgOXSoTrePEJUzzLbWEjwJmhLfNrHxKviZVZvSbbGAAZvZWAtGfNXjXHOAkDxPvIyiCVnzgFniGBpAQMahZwtWmUehkVGUeQrSUgbqwKsKgPGcngJmliPxDoIHTlo$" Hai.xltx filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2060 thread_handle: 0x00000138 process_identifier: 2064 current_directory: filepath: C:\Users\test22\AppData\Roaming\Cubi.exe.com track: 1 command_line: Cubi.exe.com g filepath_r: C:\Users\test22\AppData\Roaming\Cubi.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
NtResumeThread Sept. 9, 2021, 4:29 p.m.	thread_handle: 0x00000138 suspend_count: 0 process_identifier: 2064	1	0
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2100 thread_handle: 0x00000140 process_identifier: 260 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping TEST22-PC filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 2288 thread_handle: 0x00000164 process_identifier: 2748 current_directory: C:\Users\test22\AppData\Roaming filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\Cubi.exe.com g filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000168	1	1
CreateProcessInternalW Sept. 9, 2021, 4:29 p.m.	thread_identifier: 1444 thread_handle: 0x00000228 process_identifier: 2252 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\Cubi.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtGetContextThread Sept. 9, 2021, 4:29 p.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory Sept. 9, 2021, 4:29 p.m.	process_identifier: 2252 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory Sept. 9, 2021, 4:29 p.m.	buffer: base_address: 0x000c0000 process_identifier: 2252 process_handle: 0x0000022c	1	1
WriteProcessMemory Sept. 9, 2021, 4:29 p.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 2252 process_handle: 0x0000022c	1	1
NtSetContextThread Sept. 9, 2021, 4:29 p.m.	registers.eip: 2000355780 registers.esp: 8191092 registers.edi: 0 registers.eax: 809246 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 2252	1	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Agent.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46942107
FireEye	Generic.mg.b9424401181e75b5
ALYac	Trojan.GenericKD.46942107
Cylance	Unsafe
Zillya	Trojan.Generic.Win32.1316556
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Backdoor:Win32/Coins.f7e2e370
K7GW	Trojan ( 005820031 )
K7AntiVirus	Trojan ( 005820031 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
Paloalto	generic.ml
ClamAV	Win.Packed.Filerepmalware-9864117-0
Kaspersky	Backdoor.Win32.Agent.myudmd
BitDefender	Trojan.GenericKD.46942107
Avast	NSIS:RansomX-gen [Ransom]
Ad-Aware	Trojan.GenericKD.46942107
McAfee-GW-Edition	BehavesLike.Win32.Dropper.rc
Emsisoft	Trojan.GenericKD.46942107 (B)
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_97%
Avira	HEUR/AGEN.1140896
Microsoft	Trojan:Script/Phonzy.C!ml
GData	Win32.Trojan.BSE.HLJWVB
Cynet	Malicious (score: 100)
AhnLab-V3	Dropper/Win32.Agent.C4204264
McAfee	Artemis!B9424401181E
MAX	malware (ai score=86)
Malwarebytes	Malware.AI.3005362190
APEX	Malicious
Tencent	Win32.Backdoor.Agent.Pfiw
AVG	NSIS:RansomX-gen [Ransom]
Panda	Trj/CI.A

lv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All