Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 23, 2021, 10:01 a.m.	Oct. 23, 2021, 10:03 a.m.

Size	2.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`398371c8cc3528881ea5d49f678a541e`
SHA256	`3b79b459fa58a0a61d976fa60734e11fce3abd93158a70ed2b9a71cac23fcd05`
CRC32	`2FC271D3`
ssdeep	`49152:sjPqmxYYx9DBirx9I4Rq1hVPsH7wfXD0gfXJfPkvstmnP:2P7xD9gx9O75sH7Y0gfZfPDtm`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file themida_packer - themida packer

139.exe "C:\Users\test22\AppData\Local\Temp\139.exe"
2484

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
144.76.183.53	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 23, 2021, 10:01 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 23, 2021, 10:01 a.m.			0	0
IsDebuggerPresent Oct. 23, 2021, 10:01 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb430 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb430 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb470 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb8b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005eb930 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ebbf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ebbf0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 23, 2021, 10:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ebab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 23, 2021, 10:01 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	v7\xea\x99\xb0bc\xea
section	.themida
section	.boot

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ Oct. 23, 2021, 10:01 a.m.	stacktrace: 139+0x3e814c @ 0xfc814c 139+0x3f500e @ 0xfd500e exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 dc 0d 4d 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 3274852 registers.edi: 12713984 registers.eax: 3274852 registers.ebp: 3274932 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2002482219 registers.ecx: 2604400640	1
__exception__ Oct. 23, 2021, 10:01 a.m.	stacktrace: exception.instruction_r: ed e9 00 9b 02 00 77 5b 3b d8 93 00 4b 56 93 00 exception.symbol: 139+0x39e3de exception.instruction: in eax, dx exception.module: 139.exe exception.exception_code: 0xc0000096 exception.offset: 3793886 exception.address: 0xf7e3de registers.esp: 3274972 registers.edi: 14835149 registers.eax: 1750617430 registers.ebp: 12713984 registers.edx: 2130532438 registers.ebx: 1964507110 registers.esi: 13 registers.ecx: 20	1
__exception__ Oct. 23, 2021, 10:01 a.m.	stacktrace: exception.instruction_r: ed e9 e4 c8 02 00 c3 e9 58 4d 04 00 f0 ec ff ff exception.symbol: 139+0x398725 exception.instruction: in eax, dx exception.module: 139.exe exception.exception_code: 0xc0000096 exception.offset: 3770149 exception.address: 0xf78725 registers.esp: 3274972 registers.edi: 14835149 registers.eax: 1447909480 registers.ebp: 12713984 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Oct. 23, 2021, 10:01 a.m.	stacktrace: 0xa46191 0xa46031 0xa451b0 0xa44d30 0xa40188 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa4623f registers.esp: 3271580 registers.edi: 53114444 registers.eax: 0 registers.ebp: 3271612 registers.edx: 5988424 registers.ebx: 53113624 registers.esi: 0 registers.ecx: 0	1
__exception__ Oct. 23, 2021, 10:01 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73d81194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73c52ba1 mscorlib+0x36dd51 @ 0x725add51 mscorlib+0x32fea6 @ 0x7256fea6 mscorlib+0x30ab40 @ 0x7254ab40 0xa4cb81 0xa4ca32 0x2fc06e5 0x2fc030a 0xa4b735 0xa49d39 0xa45035 0xa44d30 0xa40188 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73bd2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73be264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73be2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73c974ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73c97610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73d21dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73d21e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73d21f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73d2416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7427f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74507f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74504de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 dc 0d 4d 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 3271028 registers.edi: 0 registers.eax: 3271028 registers.ebp: 3271108 registers.edx: 0 registers.ebx: 5964192 registers.esi: 5988424 registers.ecx: 1344715213	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 247 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x763ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7517f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75188000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76784000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76377000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7639c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76373000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7639c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7639d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 23, 2021, 10:01 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76373000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data

Foreign language identified in PE resource (7 events)

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006bbd30

size

0x00000022

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006bbd30

size

0x00000022

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006bbd30

size

0x00000022

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006bbd30

size

0x00000022

name

None

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006beebc

size

0x0000002a

name

None

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006beebc

size

0x0000002a

name

None

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x006beebc

size

0x0000002a

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 23, 2021, 10:01 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (8 events)

section

{u'size_of_data': u'0x00018e00', u'virtual_address': u'0x00002000', u'entropy': 7.984808920310954, u'name': u' ', u'virtual_size': u'0x00032000'}

entropy

7.98480892031

description