Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 19, 2021, 10:39 a.m.	Sept. 19, 2021, 10:41 a.m.

Size	521.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`3a2984391e5a67689e60830f82700e74`
SHA256	`973a7c011bd150fd5d453b37380d0e9494e1cf51fe9abcfb435fe0a14f003f76`
CRC32	`36E09DBC`
ssdeep	`12288:kwSqFSLq4m4c0vdW6HCNsoLmQpexhI2ildXLfl+cX1GT:2qFmbmD0VW6ksoaqchI2w+cw`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description)

0d.exe "C:\Users\test22\AppData\Local\Temp\0d.exe"
2620
- 0d.exe "C:\Users\test22\AppData\Local\Temp\0d.exe"
  1644

Name	Response	Post-Analysis Lookup
telete.in	A 195.201.225.248	195.201.225.248

IP Address	Status	Action
164.124.101.2	Active	Moloch
179.43.187.185	Active	Moloch
195.201.225.248	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 195.201.225.248:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49166 195.201.225.248:443	C=US, O=Let's Encrypt, CN=R3	CN=telecut.in	be:a6:3d:e8:93:c3:13:0b:5f:1d:3a:f7:63:57:4c:39:0e:96:df:5e

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 19, 2021, 10:39 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 19, 2021, 10:39 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 19, 2021, 10:39 a.m.			0	0
IsDebuggerPresent Sept. 19, 2021, 10:39 a.m.			0	0
IsDebuggerPresent Sept. 19, 2021, 10:39 a.m.			0	0
IsDebuggerPresent Sept. 19, 2021, 10:39 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f5178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f5178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f5178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f5478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f5478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f5478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f54f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f54f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f54f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f54f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f54f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f55f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2021, 10:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007f55f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 19, 2021, 10:39 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 19, 2021, 10:39 a.m.	stacktrace: DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d36ad @ 0x724b36ad mscorlib+0x308f2d @ 0x724e8f2d 0xa73da7 0xa73291 0xa717e0 0xa710ee DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d3711 @ 0x724b3711 mscorlib+0x308f2d @ 0x724e8f2d mscorlib+0x2cb060 @ 0x724ab060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d36ad @ 0x724b36ad mscorlib+0x308f2d @ 0x724e8f2d microsoft+0x50c17 @ 0x70160c17 microsoft+0x3f33f @ 0x7014f33f microsoft+0x3edf8 @ 0x7014edf8 microsoft+0x3e3b9 @ 0x7014e3b9 microsoft+0x17e980 @ 0x7028e980 0xa707f6 0xa701df 0xa7007e DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 88 04 33 46 83 fe 31 0f 9c c0 0f b6 c0 85 c0 75 exception.instruction: mov byte ptr [ebx + esi], al exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa74a1f registers.esp: 3989708 registers.edi: 41794308 registers.eax: 102 registers.ebp: 3990200 registers.edx: 859291842 registers.ebx: 16253288 registers.esi: 0 registers.ecx: 102	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 19, 2021, 10:39 a.m.

stacktrace:

DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d36ad @ 0x724b36ad
mscorlib+0x308f2d @ 0x724e8f2d
0xa73da7
0xa73291
0xa717e0
0xa710ee
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d3711 @ 0x724b3711
mscorlib+0x308f2d @ 0x724e8f2d
mscorlib+0x2cb060 @ 0x724ab060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d36ad @ 0x724b36ad
mscorlib+0x308f2d @ 0x724e8f2d
microsoft+0x50c17 @ 0x70160c17
microsoft+0x3f33f @ 0x7014f33f
microsoft+0x3edf8 @ 0x7014edf8
microsoft+0x3e3b9 @ 0x7014e3b9
microsoft+0x17e980 @ 0x7028e980
0xa707f6
0xa701df
0xa7007e
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5

exception.instruction_r: 88 04 33 46 83 fe 31 0f 9c c0 0f b6 c0 85 c0 75
exception.instruction: mov byte ptr [ebx + esi], al
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xa74a1f
registers.esp: 3989708
registers.edi: 41794308
registers.eax: 102
registers.ebp: 3990200
registers.edx: 859291842
registers.ebx: 16253288
registers.esi: 0
registers.ecx: 102

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://179.43.187.185/
suspicious_features	GET method with no useragent header				suspicious_request	GET https://telete.in/opussenseus1

Performs some HTTP requests (2 events)

request	POST http://179.43.187.185/
request	GET https://telete.in/opussenseus1

Sends data using the HTTP POST Method (1 event)

request

POST http://179.43.187.185/

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00081a00', u'virtual_address': u'0x00002000', u'entropy': 7.6390997806256795, u'name': u'.text', u'virtual_size': u'0x000819a4'}

entropy

7.63909978063

description

A section with a high entropy has been found

entropy

0.996157540826

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 19, 2021, 10:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

179.43.187.185

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 656 region_size: 602112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274		3221225496
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 1644 region_size: 602112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0
NtProtectVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f80000 process_handle: 0x00000284	1	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 manipulating memory of non-child process 656
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 656 region_size: 602112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274		3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $G[¡:ÏÉ:ÏÉ:ÏÉXRÌÈ:ÏÉXRÊÈ¿:ÏÉXRÈÈ:ÏÉQOËÈ:ÏÉQOÌÈ:ÏÉQOÊÈS:ÏÉXRËÈ:ÏÉXRÉÈ:ÏÉXRÎÈ:ÏÉ:ÎÉð:ÏÉ[OÆÈ:ÏÉ[OÍÈ:ÏÉRich:ÏÉPEL7aà²FØÐ@0 @hUÐ R8æ8pæ@Ð°.textC±² `.rdataBÐ¶@@.dataTpFR@À.reloc RÐT@B base_address: 0x00400000 process_identifier: 1644 process_handle: 0x00000278	1	1	0
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1644 process_handle: 0x00000278	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $G[¡:ÏÉ:ÏÉ:ÏÉXRÌÈ:ÏÉXRÊÈ¿:ÏÉXRÈÈ:ÏÉQOËÈ:ÏÉQOÌÈ:ÏÉQOÊÈS:ÏÉXRËÈ:ÏÉXRÉÈ:ÏÉXRÎÈ:ÏÉ:ÎÉð:ÏÉ[OÆÈ:ÏÉ[OÍÈ:ÏÉRich:ÏÉPEL7aà²FØÐ@0 @hUÐ R8æ8pæ@Ð°.textC±² `.rdataBÐ¶@@.dataTpFR@À.reloc RÐT@B base_address: 0x00400000 process_identifier: 1644 process_handle: 0x00000278	1	1	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

FireEye	Generic.mg.3a2984391e5a6768
Cylance	Unsafe
Cybereason	malicious.ec8c32
BitDefenderTheta	Gen:NN.ZemsilF.34142.Gm0@am1SSAji
ESET-NOD32	a variant of MSIL/Kryptik.ACSK
APEX	Malicious
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	MachineLearning/Anomalous.94%
Fortinet	MSIL/Kryptik.ACSK!tr
CrowdStrike	win/malicious_confidence_60% (D)

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 called NtSetContextThread to modify thread in remote process 1644
NtSetContextThread Sept. 19, 2021, 10:39 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4458456 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 1644	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 resumed a thread in remote process 1644
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 1644	1	0	0

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2620	1	0
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2620	1	0
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2620	1	0
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2620	1	0
NtGetContextThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2620	1	0
CreateProcessInternalW Sept. 19, 2021, 10:39 a.m.	thread_identifier: 572 thread_handle: 0x00000270 process_identifier: 656 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\0d.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\0d.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000274	1	1
NtGetContextThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x00000270	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 656 region_size: 602112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274		3221225496
CreateProcessInternalW Sept. 19, 2021, 10:39 a.m.	thread_identifier: 2916 thread_handle: 0x0000027c process_identifier: 1644 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\0d.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\0d.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000278	1	1
NtGetContextThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x0000027c	1	0
NtAllocateVirtualMemory Sept. 19, 2021, 10:39 a.m.	process_identifier: 1644 region_size: 602112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $G[¡:ÏÉ:ÏÉ:ÏÉXRÌÈ:ÏÉXRÊÈ¿:ÏÉXRÈÈ:ÏÉQOËÈ:ÏÉQOÌÈ:ÏÉQOÊÈS:ÏÉXRËÈ:ÏÉXRÉÈ:ÏÉXRÎÈ:ÏÉ:ÎÉð:ÏÉ[OÆÈ:ÏÉ[OÍÈ:ÏÉRich:ÏÉPEL7aà²FØÐ@0 @hUÐ R8æ8pæ@Ð°.textC±² `.rdataBÐ¶@@.dataTpFR@À.reloc RÐT@B base_address: 0x00400000 process_identifier: 1644 process_handle: 0x00000278	1	1
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: base_address: 0x00401000 process_identifier: 1644 process_handle: 0x00000278	1	1
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: base_address: 0x0046d000 process_identifier: 1644 process_handle: 0x00000278	1	1
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: base_address: 0x00487000 process_identifier: 1644 process_handle: 0x00000278	1	1
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: base_address: 0x0048d000 process_identifier: 1644 process_handle: 0x00000278	1	1
WriteProcessMemory Sept. 19, 2021, 10:39 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1644 process_handle: 0x00000278	1	1
NtSetContextThread Sept. 19, 2021, 10:39 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4458456 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 1644	1	0
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 1644	1	0
NtResumeThread Sept. 19, 2021, 10:39 a.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 1644	1	0

0d.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All