Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 12, 2021, 9:55 a.m.	Oct. 12, 2021, 10:22 a.m.

Size	435.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`a5959a6624804559383ef7244c3f6d34`
SHA256	`6297e12930d76a5cfb6a06b365e417bea872a22160a6e4cfa34f0c37dc7e14ee`
CRC32	`65176D8A`
ssdeep	`12288:v0mwW6kqR9fz9zzQaiJBQ6w9UTecgU8PmLq:v0zbkqRJ9z8vJC6nTzT87`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware

WD10.exe "C:\Users\test22\AppData\Local\Temp\WD10.exe"
1764

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.133.110.241	Active	Moloch
195.133.18.117	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 12, 2021, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:48 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:49 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 12, 2021, 9:49 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 12, 2021, 9:48 a.m.			0	0
IsDebuggerPresent Oct. 12, 2021, 9:48 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 12, 2021, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005ea360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 12, 2021, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005ea360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 12, 2021, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005ea360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 12, 2021, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001d4e3cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 12, 2021, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001d4e3cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 12, 2021, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001d4e3cb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 12, 2021, 9:48 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef196b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002270000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef12d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d4f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 12, 2021, 9:48 a.m.	process_identifier: 1764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\WD10.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00069a00', u'virtual_address': u'0x00002000', u'entropy': 7.99854043255334, u'name': u'.text', u'virtual_size': u'0x000699f0'}

entropy

7.99854043255

description

A section with a high entropy has been found

entropy

0.972382048331

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 12, 2021, 9:48 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (2 events)

host	103.133.110.241
host	195.133.18.117

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WD10

reg_value

"C:\Users\test22\AppData\Roaming\WD10.exe"

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExW Oct. 12, 2021, 9:49 a.m.	key_handle: 0x000000000000043c regkey_r: Plugin reg_type: 3 (REG_BINARY) value: Ì½\|TÕ8\|¶lÊÍ&»id/} Å7ô4 jØDnMØdC+bÁ¨X½òìEE;HUADofnÉÝß{ÿÿû¾ßïß=sÎÌ9sæÌ)·dJÅÌÀ3Âuîc/2éß8öÿàò¼Å6Ú>ìù¢®øÃ¥-\|Ss°¶Ylà«ÄÆÆ`+_éçÛù@#_0oVûDFÚûÈ2¦2V}¥ èeúV{ á#ôéSþñÍ0ï,VÉÆé(ÿØ¸½Ú ¬°ð¼þ#üßþú'jÐ!þ%ðÛtZÖ Û®ïÆ2HsKs¤I7Ð~6nÜ×}ôo"Ucb¯®aì½jÆtrþSýæù¯[ÃÓMìñsB,êä0°B¶pöJK4cv'!éú$ vê° lÙÐPÌúaÛ@rXX!}%sQNçòÆ Q.[;w®ð@¹Z8,¶R#}eî'lrÆÙ¤ûÀcÇI³T§ ®þX'ærvÎèâlIáïªö=¬Öè´éÞ[>©ùHÙizÉ8¦Î`5;¥¿äÿóÆÜiø%Æ«±ã,ªÈYÓ 7w¨äVwÃÝÍtºNgÁü¾p¥@^®&ßn`©£Ök=ë`¬=q$\=}²¤Åptò(sÙõ¨É2Öû½f°£¤ãt4ÎËTò4Àøz´° ;±³6¨Â¦KÐÄ4ÖoTi;«%Q:¥2ïNvÄÞçJ7`Ð FÍ¼V ÖyA¨yÔìuC7À¦a;GËí$iÔF½7($uëÔ¾¨¥¢d°¾H#Ø zÙf¦n6³Èôoæ×!¿µpÕèdJþÌ©÷ûyãUÏÌ½h3)ãq5ÃíÚ!m<r¼/! 3\?zj SÉ?ðÅ·CEo4qéËýCÍÆ^X@½0 ¿ÿìÍ$zþ·>¿¤Öð;÷DîWP`ï/[ú(`ë,àãk}+D~×úÅd1ìÙq·Öð¿¿Q§hoD16ÅOïÁMùï"Ã È\ýN=\|=zä.çÞ^3^a5!« nÁW®ïá! 7ü·øE¦g§ós7{.3rëàJ£^&û¬ûyûsùkÆüÆw¯-e½Ó÷§~\)jS,hÁÖÀF¸¢æ$Îiçç'Ìi<8'ÿ3aNÜ¬¶«í¤«øß,þK¢jþ&/Ä'»½u`Èªú±ÕYEèÞÀS;hC.ªfFÕîF]ýª%\I?ñIãgÃÁFBÒÓlµçOåè¥ñi\R3xAÞ §ÙÉ¤Î¿ëÐPÛX¹@øXÅv³pmKà ÃåÔK±áB4ÞVrQ\|fQÞá(ÞÀ[:ã]+DY; R¼c¡d:à)ðû («V¿óàw5ä_ùÍðÎÉÞÖKãÊã oà0 ÙhH¿é%pmô)(;¿zøíð BçLKu5rÙs8'ÁçñIy´0â<1^PÜ8J8]Òüãæã¨-CäbM/ÌF^'OÕ7P æÿ®åñJâ\1-³3çðæ{Å&¼w¶S³Q²f&Éak±Ç§aÀe8¹h.ÑSçã¸TW]¦óXã¥"ù«£ßZÉ7G½µRr4½×mäQÞ=(oÉ °¢})çàCÈkãÌu>oú,ÎÈÂÐ³ddxa6)AjRòæ¡<ÉÓ«à¬>ÇË9+\|\ËãõC¸t¾ù«³¥ >oOZ÷Cÿ(-³A±ÉUç<9CJír©wÎ¤²iÄÐt»ò/¥A.§S2ß?Q½"A!¹ÃA¹¬p{ôËEÁò!Â; · ýHòªÂ9§Û·pbÍ¨ 2¦O2QðhºÎÆÅC×¹9÷êÒ{bÔ°!û¿Î;'a³,(µ7Ê± ÑÄ.ÉnÑR¸X¼#Ñe¢x7ªô$ªÔq¯+$ÓaÏ.{iÊw¡IgÐù«q>ÎGYÂMhéÌ Îä\É$#&otyúËf¡µÏýe'þTÔnPb²0ø"1Fó³ðDêâÜ.4·/ÊUÆÆãPêíYo]ñËcüÇ1ÑSËùÞ-ß^$zs@wÊh.71Cmü¨Í"Ò¦à2«bcÏ`ËâìIZ`&¢©ÞÑ(!FZ¨EÈÁ©.ùëÛy+ÊoEùÉ·® ëÌiHm6ÊsH÷L´Ý×§UÝÉ½Å¾ì®á9¶Ërbw<¶z²äÙ£ïUÉöV0eIúLÀ(ñÐAðëí%?ÿP.~þ÷äôûØýÐiFá0¦pÍéÝ>h.~ èö^E,Tó%£H[L³ï t²Óð1#NÞº,kä½W©&iZ OÐqzgºàp$ê8¸.¬hñâ:Vpé.¯óÁ®åkZ×.ôy'©ÞÉ8[26)UêØ4 C,M;·jÊÒ°Öñ×sn¦Ô4ÖuÙ{ÖfË.\V¸lpÙYpp7p§MÒ ¢¥'Fk<oÍ4tºÈëAôr»uió`Ä§Éòé.#Q+ã,OÃd0]^ãÇhÖ(1Ú5JFú¡ \oÕWs4öÎFéõ¶NZo^ì¸¦ÈÎ_î(¿£H`5öÔÌ;#è;´yfø`&Y{oÎ®-Y½3qF¹û:ún¦Í gX5¥Q4½üpDp3LÞiò.ÈìóÂ6ÈÜ KêÜ=¤¹ ¾ãV3pÆ;aÚ6ªJeSs¸vàLqæô^ØÛ[a@èCÝ¤ëªKôz_pmÅi°Jt»hºý í÷Æ°³rÀX(·¦Ïþn#²fÈ²\&o k Ú²m1(¼ê fã~ ìf)ºB]uZ÷MÜ=Fïâò« ÈgF(.Ì}(VãC±ZÂ_ZøL\|àá Að2nEU°T Állô»C×whoÄÁÖ]¡x.¬"ä&ilA+²©låö"Øs(Ô.èLÂØ7Ò!4HM ¦b+§QÒIîPÉMÄzF"máÖ²¨¢!¥¬÷N°'ÁjmC OE£÷;O°7Á~3 ¦Tî´ ÌnöTjOßmyhÛZãòÊ¾e¿½²[0º]¨¨Ñ1ÉWlìN<_ñÄÕíü&<9ZHàÑ.w93%}RF¤m&&@"°Î:§ÑZçkpM«pÂhÛGúE¸ôÎ¢ç,7ã,0Yû¸&n ,BH+Øù,Çt,ú«©³Öïà©µ<µÂ3v^5çuó>YÇYÝåN+guÆóîáç8x]ïÂZ§¿æ±ÂTöË×Âb·½43ÆépÁJc2ÆÈJgË-àÐ0sÑ Õû,°zNôùöÝäI¨$$Êù¹KHÎ_ÏE'ùÑ\´gtÁKlÎÎîä¸g,çp:cm¸å®n³ö^æXGY°\Ms ó<\¢C,-ÑãJsd1I=ÃÅ${)ábR<\p1=<®Ôp1©=<¶p9Çá±KòØ='"\'Âãò8Â¥y=<]ÄE¸¨.â¢@\tqÑ .&\;ÙÃ½s4ÒR@»X9Kâr,ÌåM%ËJNöÄËFÙ<®.Â¢A;\XKæ±%{»HiIáÒ!39\XKé",2ÙÓ#\XÈJ ÕdyÂeaã<\|f&yz½id¥zÉY&ñôóaÐnO9O±§o¸°$`í.¬ÈêßEdyÃey"<Â¹@XZ¸0Ø{KYºÈ>.láÒ¥Ñ ípi -=\+ÅaöÎÕë È³:]6Ú%çÉ²À£<Cå,u¤xKaÙ]¡jÃÃ¹A.,5Å.ØìáÂR sd¸,sñQáÂR<£»Ã0&\XÛE ò$ÆçDnÎçÄòX>§ÉEZ=1s M L$Òi läÆâÁçJÂÃ;gW2ä%#UÎp(óÔ£z~²Á8ÏPc7ße2î»Õ·Qfw9¤£LÞy¸®+MiMó¦ÿH»^+ÄO¸éSÍüÿ@Èp¿âá åÏ¼j½`å\|Èl\K¸ òVã©!-eáJ&-UZæÁzÚÌúÁÂÎiu é";Â#=D#aêr\N³Ù5×¨0âë¹r/.ù¬¶ £¬IÐO6gIf3H%ÈS§aÇ ,xq>u(gµ¸ËÇáè+5XÀîÃ#Þ¸tÁ5gNÄå ts¾rdVÂ<×¨B&ß¦EIUÇÔ©IUÇ$©âÄlI6ð©ùÅg£b_7ª}áÙ(XD÷~hp6*ñ#¢ËÎFÅÃÞÃÅøÍïÎF¹ÿÁµÜuuÄ³r9Î:¸þÍÃÓÂ%ÒQ§»ú¬#¹+ç#¨Ð¤T#ô$A6T{T"ô$V¡ ;ñÑð%KØ1ø7O)K!ÉdH!§v¸ )G¥Ï:\t%TØ EBZÖC[ß¥¬ZSæVÊâYj%YeX¨2µ×7ø`^02uøt©Ã¤î2Îh3FÀ-ãg¤0§Tâ°OQoXãã¢¹yýÀÙa!ýÃÅÇâmA¡SÄ9¬×qûeÏK¦Ê regkey: HKEY_CURRENT_USER\Software\5DD90616627C6E39748B836164E7482B\Plugin	1	0	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Lionic	Trojan.MSIL.Zlugin.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47139314
FireEye	Generic.mg.a5959a6624804559
CAT-QuickHeal	Backdoor.MSIL
McAfee	Artemis!A5959A662480
Cylance	Unsafe
Sangfor	Backdoor.MSIL.Zlugin.gen
K7AntiVirus	Trojan ( 00581c5a1 )
Alibaba	Backdoor:MSIL/Zlugin.4d8e067a
K7GW	Trojan ( 00581c5a1 )
Cybereason	malicious.48e272
ESET-NOD32	a variant of MSIL/Kryptik.ACRC
APEX	Malicious
Kaspersky	HEUR:Backdoor.MSIL.Zlugin.gen
BitDefender	Trojan.GenericKD.47139314
Avast	Win64:Trojan-gen
Tencent	Msil.Backdoor.Zlugin.Lmuf
Ad-Aware	Trojan.GenericKD.47139314
Sophos	Mal/Generic-S
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.47139314 (B)
Ikarus	Trojan.MSIL.Crypt
Avira	HEUR/AGEN.1144057
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/AgentTesla!ml
Arcabit	Trojan.Generic.D2CF49F2
GData	Trojan.GenericKD.47139314
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4665762
TrendMicro-HouseCall	TROJ_GEN.R002C0WJ921
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.ACRC!tr
AVG	Win64:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_70% (W)

WD10.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All