Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 11, 2021, 2:59 p.m.	Sept. 11, 2021, 3:05 p.m.

Size	4.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4053a37b2fea7c4bbf78830e6f023f66`
SHA256	`204a4f2ff51612770f297dc82687efb9734bb8f81b12d05625b2ea94635e01ce`
CRC32	`41CDB146`
ssdeep	`98304:UZjYiMYbZCrROxjZQPRTYYqXngbKO/97Va+DUz:UVYiMYSzBYY8IKO17FDe`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
2456
- hottervp.exe "C:\Users\test22\AppData\Local\Temp\smudgy\hottervp.exe"
  2232
  - cmd.exe "cmd" /c cmd < Cominciata.vsdm
    1612
    - cmd.exe cmd
      2844
      - findstr.exe findstr /V /R "^FrXsdvAKjZDcxCdZXTPolthFfQdeAGGvMbDJmxIwYRoxTVJlaoiwhkpBPswAynpFzuIXZGmClNpaWSMxiuJanFoBheUiaoVmICwMjMlLJF$" Accento.vsdm
        2200
      - Dov.exe.com Dov.exe.com R
        2332
        
        Dov.exe.com C:\Users\test22\AppData\Roaming\Dov.exe.com R
        2760
        
        Dov.exe.com C:\Users\test22\AppData\Roaming\Dov.exe.com
        1276
      - PING.EXE ping TEST22-PC
        1632
- remeetfo.exe "C:\Users\test22\AppData\Local\Temp\smudgy\remeetfo.exe"
  2752

Name	Response	Post-Analysis Lookup
MspeRJJzRqixVXITOImcbXCLOWLRc.MspeRJJzRqixVXITOImcbXCLOWLRc

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 11, 2021, 2:59 p.m.			0	0
IsDebuggerPresent Sept. 11, 2021, 2:59 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 11, 2021, 2:59 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefde3a49d remeetfo+0x4f2b02 @ 0x13fe82b02 remeetfo+0x4f820d @ 0x13fe8820d HeapWalk-0x1ce0 kernel32+0x0 @ 0x77200000 0x2afea8 0x2afea8 0x2afea8 0x3c2a62 0x393148 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 0x3b7c1000000030 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 42141 exception.address: 0x7fefde3a49d registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 2006858448 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817728 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2817736 registers.rdi: 5362155520 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 @ 0x77950bd2 exception.instruction_r: 48 cf 48 83 ec 30 4c 8b c4 48 81 ec d0 04 00 00 exception.symbol: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 exception.instruction: iretq exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 330706 exception.address: 0x77950bd2 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1
__exception__ Sept. 11, 2021, 2:59 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 2815904 registers.rsi: 0 registers.r10: 0 registers.rbx: 5362284999 registers.rsp: 2817816 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 2006107425 registers.rdi: 0 registers.rax: 2004952090 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76811000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bf2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000779f7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077950000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e22000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 2760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e22000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\smudgy\hottervp.exe
file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\smudgy\remeetfo.exe
file	C:\Users\test22\AppData\Local\Temp\nsq7A79.tmp\UAC.dll
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Users\test22\AppData\Roaming\Dov.exe.com
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Local\Temp\nsx7EDE.tmp\nsExec.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\nsq7A79.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\smudgy\hottervp.exe

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Hijack network configuration	rule	Hijack_Network
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping TEST22-PC

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: e7cd3a82e2e52ed78085e42c89eac74f205f50ef

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 1276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 159744 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x0000022c	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\AVG

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 11, 2021, 2:59 p.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 1276 process_handle: 0x0000022c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2760 called NtSetContextThread to modify thread in remote process 1276
NtSetContextThread Sept. 11, 2021, 2:59 p.m.	registers.eip: 2007957956 registers.esp: 8321156 registers.edi: 0 registers.eax: 809246 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 1276	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2844 resumed a thread in remote process 2332
NtResumeThread Sept. 11, 2021, 2:59 p.m.	thread_handle: 0x00000138 suspend_count: 0 process_identifier: 2332	1	0	0

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ Sept. 11, 2021, 2:59 p.m.	tid: 1260 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 180 thread_handle: 0x0000022c process_identifier: 2232 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\smudgy\hottervp.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000230	1	1
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 1260 thread_handle: 0x00000230 process_identifier: 2752 current_directory: filepath: track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\smudgy\remeetfo.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000022c	1	1
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 1080 thread_handle: 0x00000220 process_identifier: 1612 current_directory: filepath: track: 1 command_line: "cmd" /c cmd < Cominciata.vsdm filepath_r: stack_pivoted: 0 creation_flags: 16 (CREATE_NEW_CONSOLE) inherit_handles: 1 process_handle: 0x00000224	1	1
NtGetContextThread Sept. 11, 2021, 2:59 p.m.	thread_handle: 0xfffffffffffffffe	1	0
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 2272 thread_handle: 0x00000130 process_identifier: 2844 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000134	1	1
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 2308 thread_handle: 0x00000134 process_identifier: 2200 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^FrXsdvAKjZDcxCdZXTPolthFfQdeAGGvMbDJmxIwYRoxTVJlaoiwhkpBPswAynpFzuIXZGmClNpaWSMxiuJanFoBheUiaoVmICwMjMlLJF$" Accento.vsdm filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 1792 thread_handle: 0x00000138 process_identifier: 2332 current_directory: filepath: C:\Users\test22\AppData\Roaming\Dov.exe.com track: 1 command_line: Dov.exe.com R filepath_r: C:\Users\test22\AppData\Roaming\Dov.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000140	1	1
NtResumeThread Sept. 11, 2021, 2:59 p.m.	thread_handle: 0x00000138 suspend_count: 0 process_identifier: 2332	1	0
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 3000 thread_handle: 0x00000140 process_identifier: 1632 current_directory: C:\Users\test22\AppData\Roaming filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping TEST22-PC filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000138	1	1
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 2240 thread_handle: 0x00000164 process_identifier: 2760 current_directory: C:\Users\test22\AppData\Roaming filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\Dov.exe.com R filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000168	1	1
CreateProcessInternalW Sept. 11, 2021, 2:59 p.m.	thread_identifier: 2608 thread_handle: 0x00000228 process_identifier: 1276 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Roaming\Dov.exe.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000022c	1	1
NtGetContextThread Sept. 11, 2021, 2:59 p.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory Sept. 11, 2021, 2:59 p.m.	process_identifier: 1276 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000c0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000022c	1	0
WriteProcessMemory Sept. 11, 2021, 2:59 p.m.	buffer: base_address: 0x000c0000 process_identifier: 1276 process_handle: 0x0000022c	1	1
WriteProcessMemory Sept. 11, 2021, 2:59 p.m.	buffer: ÿÿÿÿûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 1276 process_handle: 0x0000022c	1	1
NtSetContextThread Sept. 11, 2021, 2:59 p.m.	registers.eip: 2007957956 registers.esp: 8321156 registers.edi: 0 registers.eax: 809246 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000228 process_identifier: 1276	1	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Agent.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
FireEye	Generic.mg.4053a37b2fea7c4b
ALYac	Gen:Variant.Razy.920754
Malwarebytes	Malware.AI.753280343
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.2a5500
Arcabit	Trojan.Razy.DE0CB2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Filerepmalware-9864117-0
Kaspersky	Backdoor.Win32.Agent.myudnq
BitDefender	Gen:Variant.Razy.920754
MicroWorld-eScan	Gen:Variant.Razy.920754
Tencent	Win32.Trojan-qqpass.Qqrob.Ozrv
Emsisoft	Gen:Variant.Razy.920754 (B)
Zillya	Backdoor.Agent.Win32.80430
McAfee-GW-Edition	BehavesLike.Win32.Ipamor.rc
Sophos	Mal/Generic-S
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1140896
Microsoft	Trojan:Script/Phonzy.B!ml
ZoneAlarm	HEUR:Trojan-PSW.Win32.Coins.gen
GData	Win32.Trojan.BSE.HLJWVB
AhnLab-V3	Malware/Win.Generic.C4629865
McAfee	Artemis!4053A37B2FEA
MAX	malware (ai score=82)
Cylance	Unsafe
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_95%
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_80% (W)

lv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All