Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 22, 2021, 10:06 p.m.	Sept. 22, 2021, 10:11 p.m.

Size	575.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`079627807595b290ff96d0d78f981055`
SHA256	`3f5c235293cfdde26a725b19b3cbaefc44dae026b7dff9124002f42e564df18b`
CRC32	`82F6531D`
ssdeep	`12288:iDfS0Ibw8eGGmtiK5oBXj7QX0vsl/xggE8llG7CGWqaQVyMj2rtJxd+V/r:QSXbw8eGG+FoB4YsVmgKeGWW/2RjO/r`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)

me.exe "C:\Users\test22\AppData\Local\Temp\me.exe"
2972
- me.exe "C:\Users\test22\AppData\Local\Temp\me.exe"
  1632

Name	Response	Post-Analysis Lookup
www.tanzibkarate.quest	A 37.123.118.150	37.123.118.150
www.hivizpeople.com	A 208.91.197.27	208.91.197.27
www.paraflexwork.com	A 118.27.122.218	118.27.122.218
www.theklownz.com	CNAME theklownz.com A 182.50.132.242	182.50.132.242
www.hoshibanamogurablog.com	A 118.27.122.217	118.27.122.217
www.awbnmnmammmamnre.top	A 35.205.61.67	35.205.61.67
www.highclassescorts.xyz	A 172.67.196.58 A 104.21.84.194	172.67.196.58
www.azrock-express.com	A 2.57.90.16 CNAME azrock-express.com	2.57.90.16
www.arssaf.com	A 198.54.126.239 CNAME arssaf.com	198.54.126.239

IP Address	Status	Action
118.27.122.217	Active	Moloch
118.27.122.218	Active	Moloch
164.124.101.2	Active	Moloch
172.67.196.58	Active	Moloch
182.50.132.242	Active	Moloch
198.54.126.239	Active	Moloch
2.57.90.16	Active	Moloch
208.91.197.27	Active	Moloch
35.205.61.67	Active	Moloch
37.123.118.150	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49213 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 208.91.197.27:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 172.67.196.58:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 172.67.196.58:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 172.67.196.58:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 172.67.196.58:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.101:49207 -> 208.91.197.27:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 208.91.197.27:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.101:50851 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.101:49209 -> 2.57.90.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 2.57.90.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 2.57.90.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 118.27.122.218:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 118.27.122.218:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 118.27.122.218:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 198.54.126.239:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 198.54.126.239:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 198.54.126.239:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 118.27.122.217:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 118.27.122.217:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 118.27.122.217:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 37.123.118.150:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 37.123.118.150:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 37.123.118.150:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 22, 2021, 10:06 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 22, 2021, 10:07 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (8 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.highclassescorts.xyz/n092/?KjUdv2=11C6opxYdenm4+LOW2rfkO+/DICHpdbPnaEmKVE8hnbELmTxLkPZX5P6Fg1264EmYUePHdji&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.hivizpeople.com/n092/?KjUdv2=uaY0THpqv5ZUDi4Svnm06lpodfUxh6yq2Ukbc245yKA9WepW8xtBasK/cm7V+/dOV3B20yCG&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.azrock-express.com/n092/?KjUdv2=6VGFGxLAhWflDACrW1tjo3PuomEtVGIOek9mGbZZ1PhiOx3WUVraJy+ucXchxKapmEKjNvsD&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.arssaf.com/n092/?KjUdv2=hKNhAfHVZZWwyDRcjphuVsdU/RdzYJu2V8VFy+XS+c7IxZI0SD3i+YwExSbpjKPidxarQtMx&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.theklownz.com/n092/?KjUdv2=xZ6zTG1yfWAp1S2A4OgDrOSOP6aEPheXUTMWd2UF/Jx25s5YP8n7TsdqoIzOhHQP9VHsfIVj&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.hoshibanamogurablog.com/n092/?KjUdv2=tCH+IOi2Up8kweraIwYX/Hc3cvgnI173LdgscwSYShgUiRrZl7G6IwOGnLUFyHF2za2hZ3PV&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.paraflexwork.com/n092/?KjUdv2=MqLgVgGqfes2elbeOlwDwHPLn2aU31mvDuD5RLowlV4LKA8fR2x9yHu0mSJdI8KTdqNqHPJ7&lzul=z8oHn2ihgL
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.tanzibkarate.quest/n092/?KjUdv2=mM5Ml+T6RzjtHa1ctXPWFZx/OlR+qTO/DcYgr0w797fzZ94DEcy52GQaH8JrHCfhd5GgPpkF&lzul=z8oHn2ihgL

Performs some HTTP requests (16 events)

request	POST http://www.highclassescorts.xyz/n092/
request	GET http://www.highclassescorts.xyz/n092/?KjUdv2=11C6opxYdenm4+LOW2rfkO+/DICHpdbPnaEmKVE8hnbELmTxLkPZX5P6Fg1264EmYUePHdji&lzul=z8oHn2ihgL
request	POST http://www.hivizpeople.com/n092/
request	GET http://www.hivizpeople.com/n092/?KjUdv2=uaY0THpqv5ZUDi4Svnm06lpodfUxh6yq2Ukbc245yKA9WepW8xtBasK/cm7V+/dOV3B20yCG&lzul=z8oHn2ihgL
request	POST http://www.azrock-express.com/n092/
request	GET http://www.azrock-express.com/n092/?KjUdv2=6VGFGxLAhWflDACrW1tjo3PuomEtVGIOek9mGbZZ1PhiOx3WUVraJy+ucXchxKapmEKjNvsD&lzul=z8oHn2ihgL
request	POST http://www.arssaf.com/n092/
request	GET http://www.arssaf.com/n092/?KjUdv2=hKNhAfHVZZWwyDRcjphuVsdU/RdzYJu2V8VFy+XS+c7IxZI0SD3i+YwExSbpjKPidxarQtMx&lzul=z8oHn2ihgL
request	POST http://www.theklownz.com/n092/
request	GET http://www.theklownz.com/n092/?KjUdv2=xZ6zTG1yfWAp1S2A4OgDrOSOP6aEPheXUTMWd2UF/Jx25s5YP8n7TsdqoIzOhHQP9VHsfIVj&lzul=z8oHn2ihgL
request	POST http://www.hoshibanamogurablog.com/n092/
request	GET http://www.hoshibanamogurablog.com/n092/?KjUdv2=tCH+IOi2Up8kweraIwYX/Hc3cvgnI173LdgscwSYShgUiRrZl7G6IwOGnLUFyHF2za2hZ3PV&lzul=z8oHn2ihgL
request	POST http://www.paraflexwork.com/n092/
request	GET http://www.paraflexwork.com/n092/?KjUdv2=MqLgVgGqfes2elbeOlwDwHPLn2aU31mvDuD5RLowlV4LKA8fR2x9yHu0mSJdI8KTdqNqHPJ7&lzul=z8oHn2ihgL
request	POST http://www.tanzibkarate.quest/n092/
request	GET http://www.tanzibkarate.quest/n092/?KjUdv2=mM5Ml+T6RzjtHa1ctXPWFZx/OlR+qTO/DcYgr0w797fzZ94DEcy52GQaH8JrHCfhd5GgPpkF&lzul=z8oHn2ihgL

Sends data using the HTTP POST Method (8 events)

request	POST http://www.highclassescorts.xyz/n092/
request	POST http://www.hivizpeople.com/n092/
request	POST http://www.azrock-express.com/n092/
request	POST http://www.arssaf.com/n092/
request	POST http://www.theklownz.com/n092/
request	POST http://www.hoshibanamogurablog.com/n092/
request	POST http://www.paraflexwork.com/n092/
request	POST http://www.tanzibkarate.quest/n092/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.awbnmnmammmamnre.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 71 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72832000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00433000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00434000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00435000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f122000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00438000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00439000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ad8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00951000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00952000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:06 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:07 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00953000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:07 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2021, 10:07 p.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0008f400', u'virtual_address': u'0x00002000', u'entropy': 7.828382796949332, u'name': u'.text', u'virtual_size': u'0x0008f3a0'}

entropy

7.82838279695

description

A section with a high entropy has been found

entropy

0.99652173913

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 22, 2021, 10:07 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 22, 2021, 10:07 p.m.	process_identifier: 1632 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001ec	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 22, 2021, 10:07 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL.@é8à \|0Ô@@.textL{\| ` base_address: 0x00400000 process_identifier: 1632 process_handle: 0x000001ec	1	1	0
WriteProcessMemory Sept. 22, 2021, 10:07 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1632 process_handle: 0x000001ec	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 22, 2021, 10:07 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL.@é8à \|0Ô@@.textL{\| ` base_address: 0x00400000 process_identifier: 1632 process_handle: 0x000001ec	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2972 called NtSetContextThread to modify thread in remote process 1632
NtSetContextThread Sept. 22, 2021, 10:07 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4314160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001e8 process_identifier: 1632	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2972 resumed a thread in remote process 1632
NtResumeThread Sept. 22, 2021, 10:07 p.m.	thread_handle: 0x000001e8 suspend_count: 1 process_identifier: 1632	1	0	0

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 22, 2021, 10:06 p.m.	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Sept. 22, 2021, 10:06 p.m.	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW Sept. 22, 2021, 10:07 p.m.	thread_identifier: 2572 thread_handle: 0x000001e8 process_identifier: 1632 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\me.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\me.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001ec	1	1
NtGetContextThread Sept. 22, 2021, 10:07 p.m.	thread_handle: 0x000001e8	1	0
NtAllocateVirtualMemory Sept. 22, 2021, 10:07 p.m.	process_identifier: 1632 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001ec	1	0
WriteProcessMemory Sept. 22, 2021, 10:07 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL.@é8à \|0Ô@@.textL{\| ` base_address: 0x00400000 process_identifier: 1632 process_handle: 0x000001ec	1	1
WriteProcessMemory Sept. 22, 2021, 10:07 p.m.	buffer: base_address: 0x00401000 process_identifier: 1632 process_handle: 0x000001ec	1	1
WriteProcessMemory Sept. 22, 2021, 10:07 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1632 process_handle: 0x000001ec	1	1
NtSetContextThread Sept. 22, 2021, 10:07 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4314160 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001e8 process_identifier: 1632	1	0
NtResumeThread Sept. 22, 2021, 10:07 p.m.	thread_handle: 0x000001e8 suspend_count: 1 process_identifier: 1632	1	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Lionic	Trojan.MSIL.Androm.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.grp
Malwarebytes	MachineLearning/Anomalous.94%
Alibaba	Trojan:Win32/Kryptik.ali2000016
CrowdStrike	win/malicious_confidence_70% (W)
Cyren	W32/MSIL_Kryptik.FPM.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.ACVZ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.47007250
MicroWorld-eScan	Trojan.GenericKD.47007250
Avast	FileRepMalware
Ad-Aware	Trojan.GenericKD.47007250
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.079627807595b290
Emsisoft	Trojan.GenericKD.47007250 (B)
Ikarus	Trojan.MSIL.Inject
GData	Win32.Trojan-Stealer.FormBook.3H08SZ
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Microsoft	Trojan:MSIL/AgentTesla.CVB!MTB
AhnLab-V3	Trojan/Win.AgentTesla.C4641259
MAX	malware (ai score=100)
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R06CC0DIL21
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/GenKryptik.FKWF!tr
BitDefenderTheta	Gen:NN.ZemsilF.34170.Jm0@aqnxL0c
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

me.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All