Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 15, 2021, 12:26 p.m.	Sept. 15, 2021, 12:28 p.m.

Size	692.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`64e08b4b275565cef9b49ea597d410de`
SHA256	`7f56191e1540297bcbae4b26bd33fd41ac272a1b07bdaf381af83363cb098846`
CRC32	`7F3FCDAA`
ssdeep	`12288:/dlCs82zVSSvl3N7IdhpED9Q9JbHns6VH+Kg8MpGq5uvzQG89:M2zVhldwEBQLHJng8MpGxC`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

REF-ORDER NO PO# 65081740.exe "C:\Users\test22\AppData\Local\Temp\REF-ORDER NO PO# 65081740.exe"
1328
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp"
  1776
- REF-ORDER NO PO# 65081740.exe "C:\Users\test22\AppData\Local\Temp\REF-ORDER NO PO# 65081740.exe"
  1788
  - schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp203E.tmp"
    2568
  - schtasks.exe "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp21C5.tmp"
    2604

Name	Response	Post-Analysis Lookup
mirra.hopto.org	A 185.140.53.56	185.140.53.56

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.140.53.56	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:64995 -> 8.8.8.8:53	2028681	ET POLICY DNS Query to DynDNS Domain *.hopto .org	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 15, 2021, 12:27 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 15, 2021, 12:26 p.m.			0	0
IsDebuggerPresent Sept. 15, 2021, 12:26 p.m.			0	0
IsDebuggerPresent Sept. 15, 2021, 12:27 p.m.			0	0
IsDebuggerPresent Sept. 15, 2021, 12:27 p.m.			0	0

Command line console output was observed (4 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 15, 2021, 12:27 p.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 15, 2021, 12:27 p.m.	buffer: The system cannot find the file specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 15, 2021, 12:27 p.m.	buffer: SUCCESS: The scheduled task "SMTP Host" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW Sept. 15, 2021, 12:27 p.m.	buffer: SUCCESS: The scheduled task "SMTP Host Task" has successfully been created. console_handle: 0x00000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 15, 2021, 12:26 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 15, 2021, 12:27 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72cb1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72b82ba1 mscorlib+0x2f1313 @ 0x71e31313 mscorlib+0x355fec @ 0x71e95fec mscorlib+0x32d99a @ 0x71e6d99a mscorlib+0x32d54b @ 0x71e6d54b 0xc7b4ed 0xc78b0e 0xc789ff DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72b81838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72b81737 mscorlib+0x305edf @ 0x71e45edf mscorlib+0x2e9e1b @ 0x71e29e1b mscorlib+0x2e99c1 @ 0x71e299c1 mscorlib+0x2de184 @ 0x71e1e184 0xc7850a 0xc77eb5 0xc707f3 0xc70614 system+0xaac56b @ 0x7104c56b system+0x1fe5cb @ 0x7079e5cb system+0x1fe55e @ 0x7079e55e system+0x1fe4a3 @ 0x7079e4a3 mscorlib+0x302367 @ 0x71e42367 mscorlib+0x3022a6 @ 0x71e422a6 mscorlib+0x302261 @ 0x71e42261 system+0x1fe431 @ 0x7079e431 system+0x1fe237 @ 0x7079e237 system+0x1ee37d @ 0x7078e37d system+0x1f70ea @ 0x707970ea system+0x1e56c0 @ 0x707856c0 system+0x1f6e10 @ 0x70796e10 system+0x1ee251 @ 0x7078e251 system+0x1ee229 @ 0x7078e229 system+0x1ee170 @ 0x7078e170 0x47a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7557788a system+0x2093cc @ 0x707a93cc system+0x1fdca1 @ 0x7079dca1 system+0x1fd921 @ 0x7079d921 system+0x1fd792 @ 0x7079d792 system+0x1a14bd @ 0x707414bd 0xc701ba DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b12e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bc74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bc7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c51dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c51e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c51f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c5416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7408f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d67f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d64de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 1369580 registers.edi: 0 registers.eax: 1369580 registers.ebp: 1369660 registers.edx: 0 registers.ebx: 5583120 registers.esi: 5008400 registers.ecx: 4279566669	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 15, 2021, 12:27 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72cb1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72b82ba1
mscorlib+0x2f1313 @ 0x71e31313
mscorlib+0x355fec @ 0x71e95fec
mscorlib+0x32d99a @ 0x71e6d99a
mscorlib+0x32d54b @ 0x71e6d54b
0xc7b4ed
0xc78b0e
0xc789ff
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72b81838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72b81737
mscorlib+0x305edf @ 0x71e45edf
mscorlib+0x2e9e1b @ 0x71e29e1b
mscorlib+0x2e99c1 @ 0x71e299c1
mscorlib+0x2de184 @ 0x71e1e184
0xc7850a
0xc77eb5
0xc707f3
0xc70614
system+0xaac56b @ 0x7104c56b
system+0x1fe5cb @ 0x7079e5cb
system+0x1fe55e @ 0x7079e55e
system+0x1fe4a3 @ 0x7079e4a3
mscorlib+0x302367 @ 0x71e42367
mscorlib+0x3022a6 @ 0x71e422a6
mscorlib+0x302261 @ 0x71e42261
system+0x1fe431 @ 0x7079e431
system+0x1fe237 @ 0x7079e237
system+0x1ee37d @ 0x7078e37d
system+0x1f70ea @ 0x707970ea
system+0x1e56c0 @ 0x707856c0
system+0x1f6e10 @ 0x70796e10
system+0x1ee251 @ 0x7078e251
system+0x1ee229 @ 0x7078e229
system+0x1ee170 @ 0x7078e170
0x47a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755777c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7557788a
system+0x2093cc @ 0x707a93cc
system+0x1fdca1 @ 0x7079dca1
system+0x1fd921 @ 0x7079d921
system+0x1fd792 @ 0x7079d792
system+0x1a14bd @ 0x707414bd
0xc701ba
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b12e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bc74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bc7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c51dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c51e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c51f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c5416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7408f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d67f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d64de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7566b727
registers.esp: 1369580
registers.edi: 0
registers.eax: 1369580
registers.ebp: 1369660
registers.edx: 0
registers.ebx: 5583120
registers.esi: 5008400
registers.ecx: 4279566669

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

mirra.hopto.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 107 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70692000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00501000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00504000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:26 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00508000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00509000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00621000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1328 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00623000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (4 events)

cmdline	schtasks.exe /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp"
cmdline	"schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp21C5.tmp"
cmdline	"schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp203E.tmp"

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 15, 2021, 12:27 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp" filepath: schtasks.exe	1	1
CreateProcessInternalW Sept. 15, 2021, 12:27 p.m.	thread_identifier: 900 thread_handle: 0x000002cc process_identifier: 2568 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp203E.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002d0	1	1
CreateProcessInternalW Sept. 15, 2021, 12:27 p.m.	thread_identifier: 328 thread_handle: 0x000002cc process_identifier: 2604 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp21C5.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002d8	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0007e200', u'virtual_address': u'0x00002000', u'entropy': 7.915013457002043, u'name': u'.text', u'virtual_size': u'0x0007e0a0'}

entropy

7.915013457

description

A section with a high entropy has been found

entropy

0.729573391179

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 15, 2021, 12:27 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	schtasks.exe /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp"
cmdline	"schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp21C5.tmp"
cmdline	"schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp203E.tmp"

One or more of the buffers contains an embedded PE file (14 events)

buffer	Buffer with sha1: 9420a2004c14c4a5e31290936a07bd58dcaa15b3
buffer	Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9
buffer	Buffer with sha1: 4380fb6de89a7776d52214359ce213d24a2239ad
buffer	Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer	Buffer with sha1: c1ef2ca62189121934d1a7944ef1bdc1aa319877
buffer	Buffer with sha1: 063fb8b27c0872c54bff35e2b76d8f522e13f8b4
buffer	Buffer with sha1: 925c5236c59dd8f3efea4b3e091ef735b405a880
buffer	Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer	Buffer with sha1: dcdec0ea839844e977c1151d2eeedbb0788a34b1
buffer	Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: efa4948abb218e47d809bedd1aff08cfb76d40e1
buffer	Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c0	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 15, 2021, 12:27 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

REF-ORDER NO PO# 65081740.exe tried to sleep 3524787110 seconds, actually delayed analysis time by 3524787110 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host

reg_value

C:\Program Files (x86)\SMTP Host\smtphost.exe

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW È_ H.textÇ È `.relocÊ@B.rsrcÈ_ `Ì@@ base_address: 0x00400000 process_identifier: 1788 process_handle: 0x000003c0	1	1
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: à7 base_address: 0x00420000 process_identifier: 1788 process_handle: 0x000003c0	1	1
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1788 process_handle: 0x000003c0	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW È_ H.textÇ È `.relocÊ@B.rsrcÈ_ `Ì@@ base_address: 0x00400000 process_identifier: 1788 process_handle: 0x000003c0	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1328 called NtSetContextThread to modify thread in remote process 1788
NtSetContextThread Sept. 15, 2021, 12:27 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c4 process_identifier: 1788	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\REF-ORDER NO PO# 65081740.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1328 resumed a thread in remote process 1788
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000003c4 suspend_count: 1 process_identifier: 1788	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.64e08b4b275565ce
McAfee	Artemis!64E08B4B2755
Cylance	Unsafe
Cyren	W32/MSIL_Troj.BLU.gen!Eldorado
Symantec	Scr.Malcode!gdn34
ESET-NOD32	a variant of MSIL/Kryptik.ACTV
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Avast	FileRepMalware
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Woreflint.A!cl
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.C4631799
Malwarebytes	Trojan.Crypt.MSIL
Fortinet	MSIL/GenKryptik.FKNA!tr
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

Executed a process and injected code into it, probably while unpacking (37 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 15, 2021, 12:26 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1328	1	0
NtResumeThread Sept. 15, 2021, 12:26 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1328	1	0
NtResumeThread Sept. 15, 2021, 12:26 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1328	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 1328	1	0
CreateProcessInternalW Sept. 15, 2021, 12:27 p.m.	thread_identifier: 2760 thread_handle: 0x00000440 process_identifier: 1776 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aFrYnNbB" /XML "C:\Users\test22\AppData\Local\Temp\tmp1DDC.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000448	1	1
CreateProcessInternalW Sept. 15, 2021, 12:27 p.m.	thread_identifier: 1580 thread_handle: 0x000003c4 process_identifier: 1788 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\REF-ORDER NO PO# 65081740.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\REF-ORDER NO PO# 65081740.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003c0	1	1
NtGetContextThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000003c4	1	0
NtAllocateVirtualMemory Sept. 15, 2021, 12:27 p.m.	process_identifier: 1788 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c0	1	0
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW È_ H.textÇ È `.relocÊ@B.rsrcÈ_ `Ì@@ base_address: 0x00400000 process_identifier: 1788 process_handle: 0x000003c0	1	1
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: base_address: 0x00402000 process_identifier: 1788 process_handle: 0x000003c0	1	1
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: à7 base_address: 0x00420000 process_identifier: 1788 process_handle: 0x000003c0	1	1
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: base_address: 0x00422000 process_identifier: 1788 process_handle: 0x000003c0	1	1
WriteProcessMemory Sept. 15, 2021, 12:27 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1788 process_handle: 0x000003c0	1	1
NtSetContextThread Sept. 15, 2021, 12:27 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c4 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000003c4 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 1788	1	0
CreateProcessInternalW Sept. 15, 2021, 12:27 p.m.	thread_identifier: 900 thread_handle: 0x000002cc process_identifier: 2568 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\test22\AppData\Local\Temp\tmp203E.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002d0	1	1
CreateProcessInternalW Sept. 15, 2021, 12:27 p.m.	thread_identifier: 328 thread_handle: 0x000002cc process_identifier: 2604 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "SMTP Host Task" /xml "C:\Users\test22\AppData\Local\Temp\tmp21C5.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002d8	1	1
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x0000030c suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 1788	1	0
NtGetContextThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread Sept. 15, 2021, 12:27 p.m.	registers.eip: 1924672388 registers.esp: 1369788 registers.edi: 0 registers.eax: 63885312 registers.ebp: 1369832 registers.edx: 98 registers.ebx: 38715875 registers.esi: 1735554402 registers.ecx: 1937075502 thread_handle: 0x000000e4 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000003cc suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x0000041c suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x0000046c suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x00000484 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000004a0 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:27 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 1788	1	0
NtResumeThread Sept. 15, 2021, 12:28 p.m.	thread_handle: 0x000004c0 suspend_count: 1 process_identifier: 1788	1	0

REF-ORDER NO PO# 65081740.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All