popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

7742_1636811177_5077.exe

Generic Malware UPX Code injection ScreenShot Internet API DNS Http API persistence Socket AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 14, 2021, 6:06 p.m. Nov. 14, 2021, 6:08 p.m.
Size 58.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 aa557208f21ea676ff97d6cee2566ffe
SHA256 2c38920864774dad1c2f43546ace95b8fb09ccb8439e5d7389639fbc1c9153b2
CRC32 7B18492E
ssdeep 768:8NLNCnx3esWefu390ji3cUugBmoK+3dUyqFTpH0vQIVN2dOrjWyBoRJ8HUQ+K:MC0190EmoK4duVHeVNcOrjWyaK
PDB Path C:\Users\Administrator\Desktop\New folder\bin\Debug\SLN\AnthonySantosInventoryManagementSystem\obj\Debug\AVgJAName_1189_laawzuNf.exe.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.130.233
IP Address Status Action
162.159.129.233 Active Moloch
164.124.101.2 Active Moloch
45.61.138.237 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 162.159.129.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 45.61.138.237:8573 2034281 ET MALWARE TinyNuke VNC Checkin A Network Trojan was detected
TCP 192.168.56.101:49167 -> 45.61.138.237:8573 2034281 ET MALWARE TinyNuke VNC Checkin A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49162
162.159.129.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path C:\Users\Administrator\Desktop\New folder\bin\Debug\SLN\AnthonySantosInventoryManagementSystem\obj\Debug\AVgJAName_1189_laawzuNf.exe.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/902978026868965390/909005676829880410/AnthonySantosInventoryManagementSystem.dll
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/908722977724563480/909071436805726248/Client.exe
request GET https://cdn.discordapp.com/attachments/902978026868965390/909005676829880410/AnthonySantosInventoryManagementSystem.dll
request GET https://cdn.discordapp.com/attachments/908722977724563480/909071436805726248/Client.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00770000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02050000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00760000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00761000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73552000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00771000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00775000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00763000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00764000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74344000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e77000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e7e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05580000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05581000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_ENGLISH filetype data sublanguage SUBLANG_ENGLISH_AUS offset 0x000100a0 size 0x00000334
APEX Malicious
Kaspersky UDS:Trojan-Banker.MSIL.TinyNuke.gen
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Take ScreenShot rule ScreenShot
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Install itself for autorun at Windows startup rule Persistence
buffer Buffer with sha1: 5cca045e55182392dcc982543ffacff818564f2e
host 45.61.138.237
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2992
region_size: 1261568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000005dc
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $õ;Ó¤±Z½÷±Z½÷±Z½÷Ô<¾ö¼Z½÷Ô<¸ö%Z½÷Ô<¹ö£Z½÷ã2¸öšZ½÷ã2¹ö Z½÷ã2¾ö£Z½÷Ô<¼ö´Z½÷±Z¼÷ÓZ½÷3¸ö·Z½÷3B÷°Z½÷3¿ö°Z½÷Rich±Z½÷PEL p³aà Ì O@@@,’<À<РY*88*@,.textbssµ à.text—Ê Ì  `.rdataR]ð^Ð @@.data`5P. @À.idataa > @@.msvcjmcç L @À.00cfg°N @@.rsrc<ÀP @@.reloc{iÐjV @B
base_address: 0x00400000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: ””¦”¶”ĔҔޔì”ô”••"•>•P•`•x••ž•ª•À•Ž›~›j›ü•–.–L–`–|––¢–¸–Ζޖê–ö–——&—@—V—p—†—˜—¬——ԗ𗘘$˜<˜d˜p˜~˜Œ˜–˜¦˜¼˜ؘ̘æ˜ø˜ ™™*™>™L™b™r™Š™–™ª™º™̙֙â™î™š"š<šLš^špš€š–š¬š¾šКâšòš› ›$›4›H›X›ž›â•h’ԕd”ð•ü‘””¦”¶”ĔҔޔì”ô”••"•>•P•`•x••ž•ª•À•Ž›~›j›ü•–.–L–`–|––¢–¸–Ζޖê–ö–——&—@—V—p—†—˜—¬——ԗ𗘘$˜<˜d˜p˜~˜Œ˜–˜¦˜¼˜ؘ̘æ˜ø˜ ™™*™>™L™b™r™Š™–™ª™º™̙֙â™î™š"š<šLš^špš€š–š¬š¾šКâšòš› ›$›4›H›X›ž›â•®GetProcAddressÁLoadLibraryAÃCreateFileAKGetFileSizesReadFile†CloseHandle}SleepŒTerminateProcess OpenProcess,lstrcatAüCreateToolhelp32Snapshot+Process32First-Process32Next1EnterCriticalSection½LeaveCriticalSectionÊLocalAlloc;lstrlenA×WaitForSingleObjectGetConsoleWindowKERNEL32.dll‡ShowWindowUSER32.dllGetCurrentThreadId­UnhandledExceptionFiltermSetUnhandledExceptionFilterGetCurrentProcess†IsProcessorFeaturePresentIsDebuggerPresentbRaiseExceptionïMultiByteToWideCharþWideCharToMultiByteaGetLastErrorEHeapAllocIHeapFree´GetProcessHeapÎVirtualQuery«FreeLibraryMQueryPerformanceCounterGetCurrentProcessIdéGetSystemTimeAsFileTimecInitializeSListHeadÐGetStartupInfoWxGetModuleHandleWtGetModuleFileNameWÃLoadLibraryExWoInterlockedPushEntrySListlInterlockedFlushSListÓRtlUnwind2SetLastErrorDeleteCriticalSection_InitializeCriticalSectionAndSpinCountžTlsAlloc TlsGetValue¡TlsSetValueŸTlsFree-EncodePointerwGetModuleHandleExWÒGetStdHandleWriteFile^ExitProcessÖGetCommandLineA×GetCommandLineWQHeapValidateãGetSystemInfoGetCurrentThreadNGetFileTypeOutputDebugStringWWriteConsoleWéSetConsoleCtrlHandleruFindClose{FindFirstFileExWŒFindNextFileW‹IsValidCodePage²GetACP—GetOEMCPÁGetCPInfo7GetEnvironmentStringsWªFreeEnvironmentStringsWSetEnvironmentVariableWJSetStdHandle×GetStringTypeWeGetLocaleInfoWIsValidLocaleGetUserDefaultLCIDTEnumSystemLocalesW!GetDateFormatW GetTimeFormatW›CompareStringW±LCMapStringWLHeapReAllocNHeapSizeKHeapQueryInformationLGetFileSizeEx#SetFilePointerExêGetConsoleCPüGetConsoleModeŸFlushFileBuffers DecodePointerpReadConsoleWËCreateFileW
base_address: 0x00529000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: 
base_address: 0x0052a000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: 8E
base_address: 0x0052b000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: €0€ HpÁ}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0052c000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2992
process_handle: 0x000005dc
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $õ;Ó¤±Z½÷±Z½÷±Z½÷Ô<¾ö¼Z½÷Ô<¸ö%Z½÷Ô<¹ö£Z½÷ã2¸öšZ½÷ã2¹ö Z½÷ã2¾ö£Z½÷Ô<¼ö´Z½÷±Z¼÷ÓZ½÷3¸ö·Z½÷3B÷°Z½÷3¿ö°Z½÷Rich±Z½÷PEL p³aà Ì O@@@,’<À<РY*88*@,.textbssµ à.text—Ê Ì  `.rdataR]ð^Ð @@.data`5P. @À.idataa > @@.msvcjmcç L @À.00cfg°N @@.rsrc<ÀP @@.reloc{iÐjV @B
base_address: 0x00400000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0
Process injection Process 2776 called NtSetContextThread to modify thread in remote process 2992
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4542226
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000005e0
process_identifier: 2992
1 0 0
Process injection Process 2776 resumed a thread in remote process 2992
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000005e0
suspend_count: 1
process_identifier: 2992
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2776
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 2776
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2776
1 0 0

NtResumeThread

 thread_handle: 0x000003b0
suspend_count: 1
process_identifier: 2776
1 0 0

CreateProcessInternalW

 thread_identifier: 2996
thread_handle: 0x000005e0
process_identifier: 2992
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\7742_1636811177_5077.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\7742_1636811177_5077.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000005dc
1 1 0

NtGetContextThread

 thread_handle: 0x000005e0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2992
region_size: 1261568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000005dc
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $õ;Ó¤±Z½÷±Z½÷±Z½÷Ô<¾ö¼Z½÷Ô<¸ö%Z½÷Ô<¹ö£Z½÷ã2¸öšZ½÷ã2¹ö Z½÷ã2¾ö£Z½÷Ô<¼ö´Z½÷±Z¼÷ÓZ½÷3¸ö·Z½÷3B÷°Z½÷3¿ö°Z½÷Rich±Z½÷PEL p³aà Ì O@@@,’<À<РY*88*@,.textbssµ à.text—Ê Ì  `.rdataR]ð^Ð @@.data`5P. @À.idataa > @@.msvcjmcç L @À.00cfg°N @@.rsrc<ÀP @@.reloc{iÐjV @B
base_address: 0x00400000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00452000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004ff000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00525000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: ””¦”¶”ĔҔޔì”ô”••"•>•P•`•x••ž•ª•À•Ž›~›j›ü•–.–L–`–|––¢–¸–Ζޖê–ö–——&—@—V—p—†—˜—¬——ԗ𗘘$˜<˜d˜p˜~˜Œ˜–˜¦˜¼˜ؘ̘æ˜ø˜ ™™*™>™L™b™r™Š™–™ª™º™̙֙â™î™š"š<šLš^špš€š–š¬š¾šКâšòš› ›$›4›H›X›ž›â•h’ԕd”ð•ü‘””¦”¶”ĔҔޔì”ô”••"•>•P•`•x••ž•ª•À•Ž›~›j›ü•–.–L–`–|––¢–¸–Ζޖê–ö–——&—@—V—p—†—˜—¬——ԗ𗘘$˜<˜d˜p˜~˜Œ˜–˜¦˜¼˜ؘ̘æ˜ø˜ ™™*™>™L™b™r™Š™–™ª™º™̙֙â™î™š"š<šLš^špš€š–š¬š¾šКâšòš› ›$›4›H›X›ž›â•®GetProcAddressÁLoadLibraryAÃCreateFileAKGetFileSizesReadFile†CloseHandle}SleepŒTerminateProcess OpenProcess,lstrcatAüCreateToolhelp32Snapshot+Process32First-Process32Next1EnterCriticalSection½LeaveCriticalSectionÊLocalAlloc;lstrlenA×WaitForSingleObjectGetConsoleWindowKERNEL32.dll‡ShowWindowUSER32.dllGetCurrentThreadId­UnhandledExceptionFiltermSetUnhandledExceptionFilterGetCurrentProcess†IsProcessorFeaturePresentIsDebuggerPresentbRaiseExceptionïMultiByteToWideCharþWideCharToMultiByteaGetLastErrorEHeapAllocIHeapFree´GetProcessHeapÎVirtualQuery«FreeLibraryMQueryPerformanceCounterGetCurrentProcessIdéGetSystemTimeAsFileTimecInitializeSListHeadÐGetStartupInfoWxGetModuleHandleWtGetModuleFileNameWÃLoadLibraryExWoInterlockedPushEntrySListlInterlockedFlushSListÓRtlUnwind2SetLastErrorDeleteCriticalSection_InitializeCriticalSectionAndSpinCountžTlsAlloc TlsGetValue¡TlsSetValueŸTlsFree-EncodePointerwGetModuleHandleExWÒGetStdHandleWriteFile^ExitProcessÖGetCommandLineA×GetCommandLineWQHeapValidateãGetSystemInfoGetCurrentThreadNGetFileTypeOutputDebugStringWWriteConsoleWéSetConsoleCtrlHandleruFindClose{FindFirstFileExWŒFindNextFileW‹IsValidCodePage²GetACP—GetOEMCPÁGetCPInfo7GetEnvironmentStringsWªFreeEnvironmentStringsWSetEnvironmentVariableWJSetStdHandle×GetStringTypeWeGetLocaleInfoWIsValidLocaleGetUserDefaultLCIDTEnumSystemLocalesW!GetDateFormatW GetTimeFormatW›CompareStringW±LCMapStringWLHeapReAllocNHeapSizeKHeapQueryInformationLGetFileSizeEx#SetFilePointerExêGetConsoleCPüGetConsoleModeŸFlushFileBuffers DecodePointerpReadConsoleWËCreateFileW
base_address: 0x00529000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: 
base_address: 0x0052a000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: 8E
base_address: 0x0052b000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: €0€ HpÁ}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0052c000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0052d000
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2992
process_handle: 0x000005dc
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4542226
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000005e0
process_identifier: 2992
1 0 0

NtResumeThread

 thread_handle: 0x000005e0
suspend_count: 1
process_identifier: 2992
1 0 0