Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 30, 2021, 9:29 a.m.	Sept. 30, 2021, 9:31 a.m.

Size	974.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d51f8036b14a72ad278e0c0d1202ebbe`
SHA256	`cf6ce67191cc8560c728cef61aa68026540656dc1eb22ce646fc67280bbb7316`
CRC32	`B62E9AF3`
ssdeep	`24576:8D4VHfQe6ZyWshg+qbZxTZZWunAWvGPSg0Q0ctsT0h0acLJfLWaJHCZ/L:cmag0Q0ctGa2f71eL`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

ABG.exe "C:\Users\test22\AppData\Local\Temp\ABG.exe"
1548
- ABG.exe "C:\Users\test22\AppData\Local\Temp\ABG.exe"
  456
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
    1788
    - cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\win32.exe"
      2712
      - win32.exe C:\Users\test22\AppData\Roaming\win32.exe
        1956
        
        win32.exe "C:\Users\test22\AppData\Roaming\win32.exe"
        1052

Name	Response	Post-Analysis Lookup
jamaru1444.myftp.biz	A 103.133.111.149	103.133.111.149

IP Address	Status	Action
103.133.111.149	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:52062 -> 164.124.101.2:53	2013823	ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain	Potentially Bad Traffic
UDP 192.168.56.102:52062 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49172 103.133.111.149:2019	None	None	None

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 30, 2021, 9:29 a.m.			0	0
IsDebuggerPresent Sept. 30, 2021, 9:29 a.m.			0	0
IsDebuggerPresent Sept. 30, 2021, 9:30 a.m.			0	0
IsDebuggerPresent Sept. 30, 2021, 9:30 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 30, 2021, 9:29 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 30, 2021, 9:30 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73351194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73222ba1 0x11a3792 0x11a0c65 mscorlib+0xd3689c @ 0x72f1689c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x7333a6d8 CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x7333a737 PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x7331ec81 PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x7331ed29 mscorlib+0x389e52 @ 0x72569e52 mscorlib+0x309c30 @ 0x724e9c30 mscorlib+0x2eb9eb @ 0x724cb9eb mscorlib+0x2d7cd5 @ 0x724b7cd5 mscorlib+0x2d77bd @ 0x724b77bd mscorlib+0x2d74ff @ 0x724b74ff mscorlib+0x2d71c3 @ 0x724b71c3 mscorlib+0x2d48ea @ 0x724b48ea mscorlib+0x35a8e9 @ 0x7253a8e9 0x57a144 0x579ffd 0x572da4 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x731c9df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x731c9e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x731c9efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x731c9fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x732f0f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x731bbcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x731a2ae9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x2d3711 @ 0x724b3711 mscorlib+0x308f2d @ 0x724e8f2d mscorlib+0x2cb060 @ 0x724ab060 0x5718ff 0x571793 0x57164e DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737 mscorlib+0x305edf @ 0x724e5edf mscorlib+0x2e9e1b @ 0x724c9e1b mscorlib+0x2e99c1 @ 0x724c99c1 mscorlib+0x2de184 @ 0x724be184 0x570fef 0x570936 0x5700e9 0x57008b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 4247268 registers.edi: 0 registers.eax: 4247268 registers.ebp: 4247348 registers.edx: 0 registers.ebx: 8621376 registers.esi: 8216440 registers.ecx: 2051577260	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 30, 2021, 9:30 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73351194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73222ba1
0x11a3792
0x11a0c65
mscorlib+0xd3689c @ 0x72f1689c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x7333a6d8
CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x7333a737
PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x7331ec81
PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x7331ed29
mscorlib+0x389e52 @ 0x72569e52
mscorlib+0x309c30 @ 0x724e9c30
mscorlib+0x2eb9eb @ 0x724cb9eb
mscorlib+0x2d7cd5 @ 0x724b7cd5
mscorlib+0x2d77bd @ 0x724b77bd
mscorlib+0x2d74ff @ 0x724b74ff
mscorlib+0x2d71c3 @ 0x724b71c3
mscorlib+0x2d48ea @ 0x724b48ea
mscorlib+0x35a8e9 @ 0x7253a8e9
0x57a144
0x579ffd
0x572da4
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x731c9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x731c9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x731c9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x731c9fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x732f0f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x731bbcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x731a2ae9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x2d3711 @ 0x724b3711
mscorlib+0x308f2d @ 0x724e8f2d
mscorlib+0x2cb060 @ 0x724ab060
0x5718ff
0x571793
0x57164e
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73221838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73221737
mscorlib+0x305edf @ 0x724e5edf
mscorlib+0x2e9e1b @ 0x724c9e1b
mscorlib+0x2e99c1 @ 0x724c99c1
mscorlib+0x2de184 @ 0x724be184
0x570fef
0x570936
0x5700e9
0x57008b
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7566b727
registers.esp: 4247268
registers.edi: 0
registers.eax: 4247268
registers.ebp: 4247348
registers.edx: 0
registers.ebx: 8621376
registers.esi: 8216440
registers.ecx: 2051577260

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

jamaru1444.myftp.biz

Allocates read-write-execute memory (usually to unpack itself) (50 out of 67 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00305000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70692000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:29 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00571000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00573000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00574000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

win32.exe tried to sleep 129 seconds, actually delayed analysis time by 129 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\win32.exe"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 30, 2021, 9:30 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\install.vbs parameters: filepath: C:\Users\test22\AppData\Local\Temp\install.vbs	1	1	0
ShellExecuteExW Sept. 30, 2021, 9:30 a.m.	show_type: 0 filepath_r: cmd parameters: /c "C:\Users\test22\AppData\Roaming\win32.exe" filepath: cmd	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000f2e00', u'virtual_address': u'0x00002000', u'entropy': 7.264426725895252, u'name': u'.text', u'virtual_size': u'0x000f2d2c'}

entropy

7.2644267259

description

A section with a high entropy has been found

entropy

0.997945557268

description

Overall entropy of this PE file is high

Yara rule detected in process memory (38 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	browser info stealer	rule	infoStealer_browser_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	browser info stealer	rule	infoStealer_browser_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 456 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	1	0	0
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1052 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000270	1	0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win				reg_value	"C:\Users\test22\AppData\Roaming\win32.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win				reg_value	"C:\Users\test22\AppData\Roaming\win32.exe"

Potential code injection by writing to the memory of another process (10 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPEL¹8aà ÷0@èÜÀJP8l8l8l@0t.textf `.rdataXo0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcÀJL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x0046e000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÛÓÀÓ?TØnØ?¼Ø?Ùr?u 5´4ë³ØÞ}Í}ôðð??(p'vØBØ^¥«õÝÝÍ½ijQiÞöC£¥'¡(dö¼Ù¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPEL¹8aà ÷0@èÜÀJP8l8l8l@0t.textf `.rdataXo0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcÀJL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x0046e000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÛÓÀÓ?TØnØ?¼Ø?Ùr?u 5´4ë³ØÞ}Í}ôðð??(p'vØBØ^¥«õÝÝÍ½ijQiÞöC£¥'¡(dö¼Ù¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1052 process_handle: 0x00000270	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPEL¹8aà ÷0@èÜÀJP8l8l8l@0t.textf `.rdataXo0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcÀJL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 456 process_handle: 0x0000026c	1	1	0
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPEL¹8aà ÷0@èÜÀJP8l8l8l@0t.textf `.rdataXo0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcÀJL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 1052 process_handle: 0x00000270	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Sept. 30, 2021, 9:30 a.m.	thread_identifier: 0 callback_function: 0x0040887b hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	2228923	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.d51f8036b14a72ad
Cylance	Unsafe
Cyren	W32/MSIL_Kryptik.FSA.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ACYQ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Fortinet	MSIL/Kryptik.ACYI!tr
CrowdStrike	win/malicious_confidence_100% (W)

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1548 called NtSetContextThread to modify thread in remote process 456
Process injection	Process 1956 called NtSetContextThread to modify thread in remote process 1052
NtSetContextThread Sept. 30, 2021, 9:30 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388637 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000268 process_identifier: 456	1	0	0
NtSetContextThread Sept. 30, 2021, 9:30 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388637 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000026c process_identifier: 1052	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	cmd /c "C:\Users\test22\AppData\Roaming\win32.exe"
parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\win32.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1548 resumed a thread in remote process 456
Process injection	Process 1956 resumed a thread in remote process 1052
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 456	1	0	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 1052	1	0	0

Executed a process and injected code into it, probably while unpacking (44 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 30, 2021, 9:29 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1548	1	0
NtResumeThread Sept. 30, 2021, 9:29 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1548	1	0
NtResumeThread Sept. 30, 2021, 9:29 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1548	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 1548	1	0
NtGetContextThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x000000e0	1	0
NtSetContextThread Sept. 30, 2021, 9:30 a.m.	registers.eip: 1931619204 registers.esp: 4247476 registers.edi: 4248344 registers.eax: 1736 registers.ebp: 4248360 registers.edx: 62819968 registers.ebx: 4248612 registers.esi: 41161496 registers.ecx: 6859 thread_handle: 0x000000e0 process_identifier: 1548	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1548	1	0
CreateProcessInternalW Sept. 30, 2021, 9:30 a.m.	thread_identifier: 532 thread_handle: 0x00000268 process_identifier: 456 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\ABG.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\ABG.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000026c	1	1
NtGetContextThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x00000268	1	0
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 456 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	1	0
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPEL¹8aà ÷0@èÜÀJP8l8l8l@0t.textf `.rdataXo0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcÀJL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00401000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00453000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x0046e000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÛÓÀÓ?TØnØ?¼Ø?Ùr?u 5´4ë³ØÞ}Í}ôðð??(p'vØBØ^¥«õÝÝÍ½ijQiÞöC£¥'¡(dö¼Ù¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00470000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00475000 process_identifier: 456 process_handle: 0x0000026c	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 456 process_handle: 0x0000026c	1	1
NtSetContextThread Sept. 30, 2021, 9:30 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388637 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000268 process_identifier: 456	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 456	1	0
CreateProcessInternalW Sept. 30, 2021, 9:30 a.m.	thread_identifier: 1580 thread_handle: 0x000002d0 process_identifier: 1788 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002c4	1	1
CreateProcessInternalW Sept. 30, 2021, 9:30 a.m.	thread_identifier: 1464 thread_handle: 0x00000334 process_identifier: 2712 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\win32.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000033c	1	1
CreateProcessInternalW Sept. 30, 2021, 9:30 a.m.	thread_identifier: 756 thread_handle: 0x00000084 process_identifier: 1956 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\win32.exe track: 1 command_line: C:\Users\test22\AppData\Roaming\win32.exe filepath_r: C:\Users\test22\AppData\Roaming\win32.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1956	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1956	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 1956	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 1956	1	0
CreateProcessInternalW Sept. 30, 2021, 9:30 a.m.	thread_identifier: 1188 thread_handle: 0x0000026c process_identifier: 1052 current_directory: filepath: C:\Users\test22\AppData\Roaming\win32.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Roaming\win32.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000270	1	1
NtGetContextThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x0000026c	1	0
NtAllocateVirtualMemory Sept. 30, 2021, 9:30 a.m.	process_identifier: 1052 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000270	1	0
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPEL¹8aà ÷0@èÜÀJP8l8l8l@0t.textf `.rdataXo0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcÀJL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00401000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00453000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x0046e000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: ÛÓÀÓ?TØnØ?¼Ø?Ùr?u 5´4ë³ØÞ}Í}ôðð??(p'vØBØ^¥«õÝÝÍ½ijQiÞöC£¥'¡(dö¼Ù¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00470000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: base_address: 0x00475000 process_identifier: 1052 process_handle: 0x00000270	1	1
WriteProcessMemory Sept. 30, 2021, 9:30 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1052 process_handle: 0x00000270	1	1
NtSetContextThread Sept. 30, 2021, 9:30 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388637 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000026c process_identifier: 1052	1	0
NtResumeThread Sept. 30, 2021, 9:30 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 1052	1	0

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

ABG.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All