popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

chrome.exe

Generic Malware PWS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 5, 2021, 9:09 a.m. Nov. 5, 2021, 9:14 a.m.
Size 403.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 bd1348111aebafff0e409c1b2103be2f
SHA256 2803e9209af7ffdb7789624470fc34e95b2c1ad4384b9c9b289eb299d4f542d8
CRC32 150F07A5
ssdeep 6144:9oUuoNX+Bf4C/n0O+n0VJHEe9HqfoqGDeegQ/dEq4itvy4t9MmztLxtlT:97ut40DJHEe9HqLQ/H4itvy4tuqLL1
PDB Path BinaryWrit.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
UDP 192.168.56.103:51935 -> 164.124.101.2:53 2026888 ET INFO DNS Query for Suspicious .icu Domain Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 104.16.15.194:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 104.16.15.194:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 104.16.15.194:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 172.67.186.67:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 172.67.186.67:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 172.67.186.67:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 194.59.164.147:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 194.59.164.147:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 194.59.164.147:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 104.16.12.194:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 104.16.12.194:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 104.16.12.194:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 34.98.99.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 34.98.99.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 34.98.99.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path BinaryWrit.pdb
suspicious_features GET method with no useragent header suspicious_request GET http://www.mattenterline.com/ahdu/?RP=BWMIfXCVwCBZ4kPUHo5ILevewL/OQPUq11vHloG6n8+6RgSroEvy/Xp4pSQfLT4KBjByDeX6&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.premiumfreebie.com/ahdu/?RP=pA8/92Taqqyr/edOF55l6xAJ8N5/LurgJoyXofQWcG3eiXNzuaCJ7ialiIHPylFIYOyLXdu0&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.mayonnaiseplant.com/ahdu/?RP=IUU74IWbOlIA4eO5JseE4L5rq6uFi9G7mf7TrMoHqwkmTO9BdkBd3mJEymV1Jr+eNwnVFv5L&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.casinoregio.com/ahdu/?RP=CnnVC659JCBf/s+HnkrNeP0VlW04JgwUHaldWS/O0ckAV/cNE2or+o5qMc/P6iXBavojXLsd&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.precisionprobusiness.com/ahdu/?RP=TR7mZMkFYNFLxkgnK9ohRrAri9/mjktn2vstWoEWtMrwBZZAgZDTEQuG3nLTAy/4Z/9uBQ9F&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.therussellpinto.com/ahdu/?RP=FyWWkuZNBKNiw3ti3UOdVU5Hgr1DOzEzl2QkUMraXjKpQY4QiOui8EANZrLKJDbreIFeolts&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.salonjedibreakthrough.com/ahdu/?RP=kq7FuFcAnnM07lCmk5HFjfPLAwdf2YmW9WCZefAxrRxE2xhDKohSicQIhVCDHgVZ6mpRU6Tj&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.mabtas.com/ahdu/?RP=I2ctfsGYkhUvoETfTOaqD9W/QRJtBP5YQR3TmNYK36BoOSwFPkoALZffdNxAVPDMm+S6HUiy&rVOp32=S0D0n6B
suspicious_features GET method with no useragent header suspicious_request GET http://www.shooternetsports.com/ahdu/?RP=7dMJn+vZMfZlM0o8wN/8vfNoZPFz0Tyb2DrTkC9f52dNgTbGYZN/V04EFPJfRjMc5RP4clkx&rVOp32=S0D0n6B
request GET http://www.mattenterline.com/ahdu/?RP=BWMIfXCVwCBZ4kPUHo5ILevewL/OQPUq11vHloG6n8+6RgSroEvy/Xp4pSQfLT4KBjByDeX6&rVOp32=S0D0n6B
request GET http://www.premiumfreebie.com/ahdu/?RP=pA8/92Taqqyr/edOF55l6xAJ8N5/LurgJoyXofQWcG3eiXNzuaCJ7ialiIHPylFIYOyLXdu0&rVOp32=S0D0n6B
request GET http://www.mayonnaiseplant.com/ahdu/?RP=IUU74IWbOlIA4eO5JseE4L5rq6uFi9G7mf7TrMoHqwkmTO9BdkBd3mJEymV1Jr+eNwnVFv5L&rVOp32=S0D0n6B
request GET http://www.casinoregio.com/ahdu/?RP=CnnVC659JCBf/s+HnkrNeP0VlW04JgwUHaldWS/O0ckAV/cNE2or+o5qMc/P6iXBavojXLsd&rVOp32=S0D0n6B
request GET http://www.precisionprobusiness.com/ahdu/?RP=TR7mZMkFYNFLxkgnK9ohRrAri9/mjktn2vstWoEWtMrwBZZAgZDTEQuG3nLTAy/4Z/9uBQ9F&rVOp32=S0D0n6B
request GET http://www.therussellpinto.com/ahdu/?RP=FyWWkuZNBKNiw3ti3UOdVU5Hgr1DOzEzl2QkUMraXjKpQY4QiOui8EANZrLKJDbreIFeolts&rVOp32=S0D0n6B
request GET http://www.salonjedibreakthrough.com/ahdu/?RP=kq7FuFcAnnM07lCmk5HFjfPLAwdf2YmW9WCZefAxrRxE2xhDKohSicQIhVCDHgVZ6mpRU6Tj&rVOp32=S0D0n6B
request GET http://www.mabtas.com/ahdu/?RP=I2ctfsGYkhUvoETfTOaqD9W/QRJtBP5YQR3TmNYK36BoOSwFPkoALZffdNxAVPDMm+S6HUiy&rVOp32=S0D0n6B
request GET http://www.shooternetsports.com/ahdu/?RP=7dMJn+vZMfZlM0o8wN/8vfNoZPFz0Tyb2DrTkC9f52dNgTbGYZN/V04EFPJfRjMc5RP4clkx&rVOp32=S0D0n6B
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73942000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00630000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00392000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00505000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0050b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00507000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0039a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a80000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00064200', u'virtual_address': u'0x00002000', u'entropy': 7.738072163387875, u'name': u'.text', u'virtual_size': u'0x000640c4'} entropy 7.73807216339 description A section with a high entropy has been found
entropy 0.993796526055 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2592
process_handle: 0x00000244
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2592
process_handle: 0x00000244
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2628
process_handle: 0x00000250
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2628
process_handle: 0x00000250
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2664
process_handle: 0x00000258
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2664
process_handle: 0x00000258
1 0 0
host 104.21.66.169
host 162.159.135.233
host 172.67.128.223
host 172.67.134.37
host 172.67.145.75
host 172.67.148.61
host 34.117.59.81
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000238
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2628
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000248
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000024c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
1 0 0
Process injection Process 2328 manipulating memory of non-child process 2592
Process injection Process 2328 manipulating memory of non-child process 2628
Process injection Process 2328 manipulating memory of non-child process 2664
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000238
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2628
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000248
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000024c
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL9î;à  r€Ð@@.text0pr `
base_address: 0x00400000
process_identifier: 2700
process_handle: 0x00000254
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2700
process_handle: 0x00000254
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL9î;à  r€Ð@@.text0pr `
base_address: 0x00400000
process_identifier: 2700
process_handle: 0x00000254
1 1 0
Process injection Process 2328 called NtSetContextThread to modify thread in remote process 2700
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000258
process_identifier: 2700
1 0 0
parent_process chrome.exe martian_process C:\Users\test22\AppData\Local\Temp\chrome.exe
Process injection Process 2328 resumed a thread in remote process 2700
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2700
1 0 0
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
FireEye Generic.mg.bd1348111aebafff
McAfee PWS-FCUF!BD1348111AEB
Cylance Unsafe
Cybereason malicious.5e0567
BitDefenderTheta Gen:NN.ZemsilF.34266.zm0@aOqBpYf
Cyren W32/MSIL_Kryptik.GAQ.gen!Eldorado
Symantec Trojan.Gen.2
ESET-NOD32 a variant of MSIL/GenKryptik.FNBG
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:MalwareX-gen [Trj]
McAfee-GW-Edition Artemis!Trojan
Microsoft Trojan:Win32/AgentTesla!ml
Cynet Malicious (score: 100)
Malwarebytes MachineLearning/Anomalous.97%
SentinelOne Static AI - Malicious PE
Fortinet MSIL/GenKryptik.FNAJ!tr
AVG Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_60% (W)
MaxSecure Trojan.Malware.300983.susgen
dead_host 162.159.135.233:443
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2328
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2328
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2328
1 0 0

CreateProcessInternalW

 thread_identifier: 2596
thread_handle: 0x0000022c
process_identifier: 2592
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\chrome.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\chrome.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000238
1 1 0

NtGetContextThread

 thread_handle: 0x0000022c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000238
3221225496 0

CreateProcessInternalW

 thread_identifier: 2632
thread_handle: 0x00000244
process_identifier: 2628
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\chrome.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\chrome.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000248
1 1 0

NtGetContextThread

 thread_handle: 0x00000244
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2628
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000248
3221225496 0

CreateProcessInternalW

 thread_identifier: 2668
thread_handle: 0x00000250
process_identifier: 2664
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\chrome.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\chrome.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000024c
1 1 0

NtGetContextThread

 thread_handle: 0x00000250
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000024c
3221225496 0

CreateProcessInternalW

 thread_identifier: 2704
thread_handle: 0x00000258
process_identifier: 2700
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\chrome.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\chrome.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000254
1 1 0

NtGetContextThread

 thread_handle: 0x00000258
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL9î;à  r€Ð@@.text0pr `
base_address: 0x00400000
process_identifier: 2700
process_handle: 0x00000254
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2700
process_handle: 0x00000254
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2700
process_handle: 0x00000254
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4313216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000258
process_identifier: 2700
1 0 0

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2700
1 0 0