Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 18, 2021, 9:26 a.m.	Oct. 18, 2021, 9:29 a.m.

Size	75.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`592bff278b2bf2551ca505447229c399`
SHA256	`24842beeccc32b2247b404694796aa988f94487b26855b0e1b2dbad88d391b33`
CRC32	`27DE6CB8`
ssdeep	`1536:o3Cmd6dyEr0YJTFfjcx8JFheeZrM3M2e:o3t+rbJTGWveeZ4te`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Dv31BrowInst.exe "C:\Users\test22\AppData\Local\Temp\Dv31BrowInst.exe"
1972
- 5001427.scr "C:\Users\test22\AppData\Roaming\5001427.scr" /S
  804
- 8178908.scr "C:\Users\test22\AppData\Roaming\8178908.scr" /S
  2316
  - WinHoster.exe "C:\Users\test22\AppData\Roaming\WinHost\WinHoster.exe"
    560

Name	Response	Post-Analysis Lookup
niemannbest.me	A 172.67.221.103 A 104.21.51.48	172.67.221.103
topniemannpickshop.cc
iplogger.org	A 88.99.66.31	88.99.66.31

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.221.103	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53	2027758	ET DNS Query for .cc TLD	Potentially Bad Traffic
TCP 192.168.56.101:49201 -> 172.67.221.103:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49206 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49207 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49201 172.67.221.103:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	16:7c:ef:5c:eb:cb:66:bc:19:9f:3a:95:c8:e3:06:1c:95:6b:0b:11
TLSv1 192.168.56.101:49206 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1 192.168.56.101:49207 88.99.66.31:443	None	None	None

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 18, 2021, 9:19 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:19 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:27 a.m.			0	0
IsDebuggerPresent Oct. 18, 2021, 9:27 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 18, 2021, 9:19 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	V11!-\x08>\x01
section

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (8 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us1
suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us2
suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us3
suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us4
suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us5
suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us6
suspicious_features	GET method with no useragent header	suspicious_request	GET https://niemannbest.me/?username=david_us7
suspicious_features	GET method with no useragent header	suspicious_request	GET https://iplogger.org/1aHhd7

Performs some HTTP requests (9 events)

request	GET https://niemannbest.me/?username=david_us1
request	GET https://niemannbest.me/?username=david_us2
request	GET https://niemannbest.me/?username=david_us3
request	GET https://niemannbest.me/?username=david_us4
request	GET https://niemannbest.me/?username=david_us5
request	GET https://niemannbest.me/?username=david_us6
request	GET https://niemannbest.me/?username=david_us7
request	GET https://iplogger.org/1aFhd7
request	GET https://iplogger.org/1aHhd7

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

topniemannpickshop.cc

description

Cocos Islands domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 157 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1271000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef190b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1272000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1274000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91afa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bd6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010b2000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91afb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c28000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010ba000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2021, 9:19 a.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000010ba000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\8178908.scr
file	C:\Users\test22\AppData\Roaming\5001427.scr

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW Oct. 18, 2021, 9:27 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\WinHost filepath: C:\Users\test22\AppData\Roaming\WinHost	1	1	0
SetFileAttributesW Oct. 18, 2021, 9:27 a.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\WinHost\WinHoster.exe filepath: C:\Users\test22\AppData\Roaming\WinHost\WinHoster.exe	1	1	0

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Roaming\5001427.scr
file	C:\Users\test22\AppData\Roaming\8178908.scr

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\8178908.scr
file	C:\Users\test22\AppData\Roaming\5001427.scr

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 18, 2021, 9:20 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\5001427.scr parameters: filepath: C:\Users\test22\AppData\Roaming\5001427.scr	1	1	0
ShellExecuteExW Oct. 18, 2021, 9:20 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\8178908.scr parameters: filepath: C:\Users\test22\AppData\Roaming\8178908.scr	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 18, 2021, 9:19 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00006800', u'virtual_address': u'0x00002000', u'entropy': 7.993411580539431, u'name': u'V11!-\\x08>\\x01', u'virtual_size': u'0x000066fc'}

entropy

7.99341158054

description

A section with a high entropy has been found

entropy

0.351351351351

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 18, 2021, 9:20 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (1 event)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Oct. 18, 2021, 9:20 a.m.	status_code: 0xffffffff process_identifier: 1972 process_handle: 0x00000000000001d8		0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WinHost

reg_value

C:\Users\test22\AppData\Roaming\WinHost\WinHoster.exe

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Lionic	Trojan.MSIL.Stealer.l!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47186266
FireEye	Generic.mg.592bff278b2bf255
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005801c61 )
Alibaba	TrojanSpy:MSIL/Stealer.a68f9bf5
K7GW	Trojan-Downloader ( 005801c61 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2D0015A
BitDefenderTheta	Gen:NN.ZemsilF.34218.eu0@a4pRpbd
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.IFK
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.47186266
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	Trojan.GenericKD.47186266
Sophos	Mal/Generic-S
DrWeb	Trojan.PWS.Stealer.31267
McAfee-GW-Edition	BehavesLike.Win32.Generic.lc
Emsisoft	Trojan.GenericKD.47186266 (B)
Ikarus	Trojan-Downloader.MSIL.Agent
Avira	TR/Dldr.Agent.mqwiq
Antiy-AVL	Trojan/Generic.ASMalwS.2ADF06B
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Heur!.03011281
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Trojan.Ilgergop.HA2GH4
Cynet	Malicious (score: 100)
McAfee	Trojan-FTYX!592BFF278B2B
MAX	malware (ai score=85)
VBA32	CIL.StupidPInvoker-1.Heur
Malwarebytes	Trojan.Crypt.MSIL.Generic
TrendMicro-HouseCall	TROJ_GEN.R002H0DJE21
Tencent	Msil.Trojan-spy.Stealer.Suxv
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	PossibleThreat.ZDS
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A

Dv31BrowInst.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All