Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 24, 2021, 5:04 p.m.	Sept. 24, 2021, 5:13 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b105bec27851dabe21e1cf1c56bfda0e`
SHA256	`ed133e3bc6f781c4a981f93c180e38c70572ad80e48c12294585767e583b9d0f`
CRC32	`0F8E39C4`
ssdeep	`12288:6sbxvLuoLXS7P2qGuV3uZlaDVEPWN53QwvJH4vNiCmLJ1GcyQizeVzhst:Vi+qDVeZlaDkWHgwq9uXiQzhst`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

6789568764240821.exe "C:\Users\test22\AppData\Local\Temp\6789568764240821.exe"
620
- 6789568764240821.exe "C:\Users\test22\AppData\Local\Temp\6789568764240821.exe"
  2936
  - vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\holdermail.txt"
    2260
  - vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\holderwb.txt"
    584

Name	Response	Post-Analysis Lookup
whatismyipaddress.com	A 104.16.154.36 A 104.16.155.36	104.16.154.36
ftp.vn-gpack.org	A 66.70.204.222	66.70.204.222

IP Address	Status	Action
104.16.154.36	Active	Moloch
164.124.101.2	Active	Moloch
66.70.204.222	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 66.70.204.222:21 -> 192.168.56.101:49211	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 24, 2021, 5:05 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 24, 2021, 5:04 p.m.			0	0
IsDebuggerPresent Sept. 24, 2021, 5:04 p.m.			0	0
IsDebuggerPresent Sept. 24, 2021, 5:05 p.m.			0	0
IsDebuggerPresent Sept. 24, 2021, 5:05 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 24, 2021, 5:04 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006e6928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 24, 2021, 5:04 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006e6228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 24, 2021, 5:04 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006e6228 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 24, 2021, 5:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00826188 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 24, 2021, 5:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00826808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 24, 2021, 5:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00826808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 24, 2021, 5:04 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (3 events)

Time & API	Arguments	Status	Return
bind Sept. 24, 2021, 5:05 p.m.	ip_address: 127.0.0.1 socket: 608 port: 0	1	0
listen Sept. 24, 2021, 5:05 p.m.	socket: 608 backlog: 2147483647	1	0
accept Sept. 24, 2021, 5:05 p.m.	ip_address: 127.0.0.1 socket: 608 port: 0		4294967295

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://whatismyipaddress.com/

Performs some HTTP requests (1 event)

request

GET http://whatismyipaddress.com/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 83 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00691000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00694000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00695000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:04 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00696000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00698000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00699000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Sept. 24, 2021, 5:05 p.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Sept. 24, 2021, 5:05 p.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1	0

Steals private information from local Internet browsers (38 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera\wand.dat
file	C:\Users\test22\AppData\Roaming\Opera\Opera7\profile\wand.dat

Looks up the external IP address (1 event)

domain

whatismyipaddress.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 24, 2021, 5:05 p.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00119400', u'virtual_address': u'0x00002000', u'entropy': 7.498436195070265, u'name': u'.text', u'virtual_size': u'0x00119384'}

entropy

7.49843619507

description

A section with a high entropy has been found

entropy

0.998225377107

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 24, 2021, 5:05 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (11 events)

url	http://www.nirsoft.net/
url	http://www.usertrust.com1
url	http://ocsp.comodoca.com0
url	http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
url	https://secure.comodo.net/CPS0A
url	http://crl.usertrust.com/UTN-USERFirst-Object.crl05
url	http://crl.usertrust.com/UTN-USERFirst-Object.crl0t
url	http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
url	http://crl.usertrust.com/AddTrustExternalCARoot.crl05
url	http://ocsp.usertrust.com0
url	http://crt.comodoca.com/COMODOCodeSigningCA2.crt0

Yara rule detected in process memory (38 events)

description	Take ScreenShot	rule	ScreenShot
description	Steal credential	rule	local_credential_Steal
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Take ScreenShot	rule	ScreenShot
description	Steal credential	rule	local_credential_Steal
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communications use DNS	rule	Network_DNS
description	Communications smtp	rule	Network_SMTP_dotNet
description	Virtual currency	rule	Virtual_currency_Zero
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Take ScreenShot	rule	ScreenShot
description	Steal credential	rule	local_credential_Steal
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2260 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000664	1
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 584 region_size: 360448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000005b4	1

A process attempted to delay the analysis task. (1 event)

description

6789568764240821.exe tried to sleep 2728368 seconds, actually delayed analysis time by 2728368 seconds

Attempts to access Bitcoin/ALTCoin wallets (1 event)

file	C:\Users\test22\AppData\Roaming\bitcoin\wallet.dat

Harvests information related to installed instant messenger clients (1 event)

registry

HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELF#aàì4¾ @ @pK 2` H.textÄë ì `.rsrc2 2î@@.reloc` @B base_address: 0x00400000 process_identifier: 2936 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: À; base_address: 0x00486000 process_identifier: 2936 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2936 process_handle: 0x0000026c	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELF#aàì4¾ @ @pK 2` H.textÄë ì `.rsrc2 2î@@.reloc` @B base_address: 0x00400000 process_identifier: 2936 process_handle: 0x0000026c	1	1	0

Harvests credentials from local email clients (6 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
registry	HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 620 called NtSetContextThread to modify thread in remote process 2936
Process injection	Process 2936 called NtSetContextThread to modify thread in remote process 2260
Process injection	Process 2936 called NtSetContextThread to modify thread in remote process 584
NtSetContextThread Sept. 24, 2021, 5:05 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4721598 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000268 process_identifier: 2936	1	0	0
NtSetContextThread Sept. 24, 2021, 5:05 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4265556 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000658 process_identifier: 2260	1	0	0
NtSetContextThread Sept. 24, 2021, 5:05 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4466216 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000005b8 process_identifier: 584	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 620 resumed a thread in remote process 2936
Process injection	Process 2936 resumed a thread in remote process 2260
Process injection	Process 2936 resumed a thread in remote process 584
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2936	1	0	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000658 suspend_count: 1 process_identifier: 2260	1	0	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005b8 suspend_count: 1 process_identifier: 584	1	0	0

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

Executed a process and injected code into it, probably while unpacking (48 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 24, 2021, 5:04 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 620	1	0
NtResumeThread Sept. 24, 2021, 5:04 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 620	1	0
NtResumeThread Sept. 24, 2021, 5:04 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 620	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 620	1	0
CreateProcessInternalW Sept. 24, 2021, 5:05 p.m.	thread_identifier: 260 thread_handle: 0x00000268 process_identifier: 2936 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\6789568764240821.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\6789568764240821.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000026c	1	1
NtGetContextThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000268	1	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2936 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	1	0
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELF#aàì4¾ @ @pK 2` H.textÄë ì `.rsrc2 2î@@.reloc` @B base_address: 0x00400000 process_identifier: 2936 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: base_address: 0x00402000 process_identifier: 2936 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: base_address: 0x00482000 process_identifier: 2936 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: À; base_address: 0x00486000 process_identifier: 2936 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 24, 2021, 5:05 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2936 process_handle: 0x0000026c	1	1
NtSetContextThread Sept. 24, 2021, 5:05 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4721598 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000268 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000047c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000004e0 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000518 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000057c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000594 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005a8 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005bc suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005e4 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005f0 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000060c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000630 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000648 suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000660 suspend_count: 1 process_identifier: 2936	1	0
CreateProcessInternalW Sept. 24, 2021, 5:05 p.m.	thread_identifier: 1224 thread_handle: 0x00000658 process_identifier: 2260 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\holdermail.txt" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000664	1	1
NtUnmapViewOfSection Sept. 24, 2021, 5:05 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2260 process_handle: 0x00000664	1	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 2260 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000664	1	0
NtGetContextThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000658	1	0
NtSetContextThread Sept. 24, 2021, 5:05 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4265556 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000658 process_identifier: 2260	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000658 suspend_count: 1 process_identifier: 2260	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000648 suspend_count: 1 process_identifier: 2936	1	0
CreateProcessInternalW Sept. 24, 2021, 5:05 p.m.	thread_identifier: 1536 thread_handle: 0x000005b8 process_identifier: 584 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\test22\AppData\Local\Temp\holderwb.txt" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000005b4	1	1
NtUnmapViewOfSection Sept. 24, 2021, 5:05 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 584 process_handle: 0x000005b4	1	0
NtAllocateVirtualMemory Sept. 24, 2021, 5:05 p.m.	process_identifier: 584 region_size: 360448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000005b4	1	0
NtGetContextThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005b8	1	0
NtSetContextThread Sept. 24, 2021, 5:05 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4466216 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000005b8 process_identifier: 584	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000005b8 suspend_count: 1 process_identifier: 584	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000058c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x0000050c suspend_count: 1 process_identifier: 2936	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2260	1	0
NtResumeThread Sept. 24, 2021, 5:05 p.m.	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 584	1	0

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.2593
FireEye	Generic.mg.b105bec27851dabe
McAfee	AgentTesla-FDBQ!B105BEC27851
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	IL:Trojan.MSILZilla.DA21
BitDefenderTheta	Gen:NN.ZemsilF.34170.gn0@aqTpVCi
Cyren	W32/Trojan.SW.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.ACPC
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
BitDefender	IL:Trojan.MSILZilla.2593
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Backdoor.Remcos.Pauv
Ad-Aware	IL:Trojan.MSILZilla.2593
Emsisoft	Trojan.Agent (A)
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Sophos	Troj/Krypt-BN
Ikarus	Trojan.MSIL.Inject
Microsoft	Trojan:MSIL/AgentTesla.CMY!MTB
GData	IL:Trojan.MSILZilla.2593
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.AgentTesla.C4605319
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
ALYac	IL:Trojan.MSILZilla.2593
MAX	malware (ai score=100)
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TROJ_GEN.R002C0DIL21
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.ABET!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.300983.susgen

6789568764240821.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All