Summary | ZeroBOX

rgncszyk9i

Generic Malware AntiVM AntiDebug
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 3, 2021, 7:59 a.m. Nov. 3, 2021, 8:03 a.m.
Size 84.2KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 eabc01068b757619a20ba4d45d5f09dd
SHA256 8af9c9d76bece9923478be75bf384175dfb90cfd61594e2bed5c5a4b3fcc1ce2
CRC32 8C219EC8
ssdeep 1536:TcSoPFh67RiCEnzo/rJV4Jx59PwpMvj7QInrLdJg9mRY1tW:knE9WJ1PRnrJJgUGW
Yara
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x748d0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73a81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73494000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73a82000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73cf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73331000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74891000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76a81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74871000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 3032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73a82000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
registry HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE
Lionic Trojan.PowerShell.Agent.b!c
Cyren PSH/Agent.CJ
ESET-NOD32 PowerShell/TrojanDropper.Agent.OQ
Avast SNH:Script [Dropper]
Kaspersky Trojan-Dropper.PowerShell.Agent.bu
Sophos Troj/Inject-HEG
McAfee-GW-Edition Artemis!Trojan
GData Script.Trojan.Agent.89K977
Microsoft Trojan:Script/Wacatac.B!ml
Tencent Win32.Trojan-dropper.Agent.Anfw
Ikarus Trojan-Dropper.PowerShell.Agent
Fortinet PowerShell/Agent.CJ!tr
AVG SNH:Script [Dropper]
registry HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\Capabilities\FileAssociations
Process injection Process 2772 resumed a thread in remote process 2920
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x0000028c
suspend_count: 1
process_identifier: 2920
1 0 0