Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 18, 2021, 7:45 a.m.	Nov. 18, 2021, 8:35 a.m.

Size	657.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b8ecacd6489899bdfa00948c3992ea92`
SHA256	`5cbe60cda67fb656a43b596866e842ddbdace4814cb50aeb7d602515f13b8d9f`
CRC32	`696691CA`
ssdeep	`12288:RZrpnpylfmz5QDL5WdabVPWxX5BKrNDKcP4Jk22XPwj5M6OJWRvuJ:RXnUKytWd+PWxX5QrVKcLJXYjOjv`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2404
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\vbc.exe"
  2724
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe"
  2860
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp"
  2908
- vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
  304
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
    2304
    - cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
      2172
      - Goldll.exe C:\Users\test22\AppData\Roaming\kl\Goldll.exe
        2536
        
        powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
        2948
        
        powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe"
        2196
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DB2.tmp"
        2780
        
        Goldll.exe "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
        292

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.5.212.11	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.103:49179 194.5.212.11:666	None	None	None

Queries for the computername (28 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 18, 2021, 7:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 18, 2021, 8:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 18, 2021, 7:45 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 7:45 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:33 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:33 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:33 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:33 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:34 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:34 a.m.			0	0

Command line console output was observed (39 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\vbc. console_handle: 0x00000053	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: exe console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\jUtbYuW console_handle: 0x00000053	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: a.exe console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 18, 2021, 8:33 a.m.	buffer: SUCCESS: The scheduled task "Updates\jUtbYuWa" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\kl\Gold console_handle: 0x00000053	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: ll.exe console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\jUtbYuW console_handle: 0x00000053	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: a.exe console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 18, 2021, 8:34 a.m.	buffer: Cannot create a file when that file already exists. console_handle: 0x0000000b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 184 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebb08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebc08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebbc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ebf88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003eb808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ec488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebd08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 8:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebd88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 18, 2021, 7:45 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 626 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73942000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00545000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:45 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a7e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a7f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e7b1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e7b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02781000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:33 a.m.	process_identifier: 2724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

Goldll.exe tried to sleep 172 seconds, actually delayed analysis time by 172 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (11 events)

cmdline	schtasks.exe /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DB2.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DB2.tmp"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\vbc.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\vbc.exe"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
cmdline	schtasks.exe /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

A process created a hidden window (8 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Nov. 18, 2021, 7:46 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\vbc.exe" filepath: powershell	1	1
ShellExecuteExW Nov. 18, 2021, 7:46 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe" filepath: powershell	1	1
ShellExecuteExW Nov. 18, 2021, 7:46 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp" filepath: schtasks.exe	1	1
ShellExecuteExW Nov. 18, 2021, 8:33 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\install.vbs parameters: filepath: C:\Users\test22\AppData\Local\Temp\install.vbs	1	1
ShellExecuteExW Nov. 18, 2021, 8:33 a.m.	show_type: 0 filepath_r: cmd parameters: /c "C:\Users\test22\AppData\Roaming\kl\Goldll.exe" filepath: cmd	1	1
ShellExecuteExW Nov. 18, 2021, 8:34 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\kl\Goldll.exe" filepath: powershell	1	1
ShellExecuteExW Nov. 18, 2021, 8:34 a.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe" filepath: powershell	1	1
ShellExecuteExW Nov. 18, 2021, 8:34 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DB2.tmp" filepath: schtasks.exe	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000a3800', u'virtual_address': u'0x00002000', u'entropy': 7.860482734698511, u'name': u'.text', u'virtual_size': u'0x000a3704'}

entropy

7.8604827347

description

A section with a high entropy has been found

entropy

0.996191926885

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (6 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 18, 2021, 7:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 18, 2021, 8:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 18, 2021, 8:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 18, 2021, 8:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 18, 2021, 8:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 18, 2021, 8:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (38 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Run a KeyLogger	rule	KeyLogger
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	browser info stealer	rule	infoStealer_browser_Zero
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Run a KeyLogger	rule	KeyLogger
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	browser info stealer	rule	infoStealer_browser_Zero

Terminates another process (6 events)

Time & API	Arguments	Status
NtTerminateProcess Nov. 18, 2021, 7:46 a.m.	status_code: 0xffffffff process_identifier: 3008 process_handle: 0x00000470
NtTerminateProcess Nov. 18, 2021, 7:46 a.m.	status_code: 0xffffffff process_identifier: 3008 process_handle: 0x00000470	1
NtTerminateProcess Nov. 18, 2021, 7:46 a.m.	status_code: 0xffffffff process_identifier: 3044 process_handle: 0x00000484
NtTerminateProcess Nov. 18, 2021, 7:46 a.m.	status_code: 0xffffffff process_identifier: 3044 process_handle: 0x00000484	1
NtTerminateProcess Nov. 18, 2021, 8:34 a.m.	status_code: 0x00000000 process_identifier: 2896 process_handle: 0x000000cc
NtTerminateProcess Nov. 18, 2021, 8:34 a.m.	status_code: 0x00000000 process_identifier: 2896 process_handle: 0x000000cc	1

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	schtasks.exe /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DB2.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DB2.tmp"
cmdline	schtasks.exe /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

194.5.212.11

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 3008 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000046c		3221225496
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 3044 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000464		3221225496
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 304 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000478	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 8:34 a.m.	process_identifier: 292 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000046c	1	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Goldll				reg_value	"C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Goldll				reg_value	"C:\Users\test22\AppData\Roaming\kl\Goldll.exe"

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2404 manipulating memory of non-child process 3008
Process injection	Process 2404 manipulating memory of non-child process 3044
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 3008 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000046c	3221225496	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 3044 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000464	3221225496	0

Potential code injection by writing to the memory of another process (10 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ª@0îb.cîb.cîb.cZþßcüb.cZþÝcOb.cZþÜcðb.cçªcïb.cpÂécìb.cÕ<-bôb.cÕ<+bÔb.cÕ<*bÌb.cç½cûb.cîb/cÏc.cy<'b±b.c\|<Ñcïb.cy<,bïb.cRichîb.cPEL;Waà 9ü0@ÜäJPÄ8 l8´lXl@0\|.text `.rdatao0p$@@.dataì? @À.tls à¢@À.gfids0ð¤@@.rsrcäJL¨@@.relocÄ8P:ô@B base_address: 0x00400000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ¬tE°wEªtE..p¡F<¶F<¶F<¶F<¶F<¶F<¶F<¶F<¶F<¶Ft¡F@¶F@¶F@¶F@¶F@¶F@¶F@¶Fx¡Fÿÿÿÿ°wE¢F¢F¢F¢F¢Fx¡F0zE°{EEØ¡Fp§FCPSTPDT ¢Fà¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZp§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: base_address: 0x0046e000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: ÙôØ?iÝÝ?ÑÝ?Ùw?zÊ@t@G##ÈÝÞÍ(öÐõ??M- ,ÝWÝÖ±ßú»Þ»Þý »#»{\|QnÊã='¢t¨ÄªX¦-ûÅÁÍÞ¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 8:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ª@0îb.cîb.cîb.cZþßcüb.cZþÝcOb.cZþÜcðb.cçªcïb.cpÂécìb.cÕ<-bôb.cÕ<+bÔb.cÕ<*bÌb.cç½cûb.cîb/cÏc.cy<'b±b.c\|<Ñcïb.cy<,bïb.cRichîb.cPEL;Waà 9ü0@ÜäJPÄ8 l8´lXl@0\|.text `.rdatao0p$@@.dataì? @À.tls à¢@À.gfids0ð¤@@.rsrcäJL¨@@.relocÄ8P:ô@B base_address: 0x00400000 process_identifier: 292 process_handle: 0x0000046c	1	1
WriteProcessMemory Nov. 18, 2021, 8:34 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ¬tE°wEªtE..p¡F<¶F<¶F<¶F<¶F<¶F<¶F<¶F<¶F<¶Ft¡F@¶F@¶F@¶F@¶F@¶F@¶F@¶Fx¡Fÿÿÿÿ°wE¢F¢F¢F¢F¢Fx¡F0zE°{EEØ¡Fp§FCPSTPDT ¢Fà¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZp§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 292 process_handle: 0x0000046c	1	1
WriteProcessMemory Nov. 18, 2021, 8:34 a.m.	buffer: base_address: 0x0046e000 process_identifier: 292 process_handle: 0x0000046c	1	1
WriteProcessMemory Nov. 18, 2021, 8:34 a.m.	buffer: ÙôØ?iÝÝ?ÑÝ?Ùw?zÊ@t@G##ÈÝÞÍ(öÐõ??M- ,ÝWÝÖ±ßú»Þ»Þý »#»{\|QnÊã='¢t¨ÄªX¦-ûÅÁÍÞ¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 292 process_handle: 0x0000046c	1	1
WriteProcessMemory Nov. 18, 2021, 8:34 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 292 process_handle: 0x0000046c	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ª@0îb.cîb.cîb.cZþßcüb.cZþÝcOb.cZþÜcðb.cçªcïb.cpÂécìb.cÕ<-bôb.cÕ<+bÔb.cÕ<*bÌb.cç½cûb.cîb/cÏc.cy<'b±b.c\|<Ñcïb.cy<,bïb.cRichîb.cPEL;Waà 9ü0@ÜäJPÄ8 l8´lXl@0\|.text `.rdatao0p$@@.dataì? @À.tls à¢@À.gfids0ð¤@@.rsrcäJL¨@@.relocÄ8P:ô@B base_address: 0x00400000 process_identifier: 304 process_handle: 0x00000478	1	1	0
WriteProcessMemory Nov. 18, 2021, 8:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ª@0îb.cîb.cîb.cZþßcüb.cZþÝcOb.cZþÜcðb.cçªcïb.cpÂécìb.cÕ<-bôb.cÕ<+bÔb.cÕ<*bÌb.cç½cûb.cîb/cÏc.cy<'b±b.c\|<Ñcïb.cy<,bïb.cRichîb.cPEL;Waà 9ü0@ÜäJPÄ8 l8´lXl@0\|.text `.rdatao0p$@@.dataì? @À.tls à¢@À.gfids0ð¤@@.rsrcäJL¨@@.relocÄ8P:ô@B base_address: 0x00400000 process_identifier: 292 process_handle: 0x0000046c	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Nov. 18, 2021, 8:34 a.m.	thread_identifier: 0 callback_function: 0x00408981 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	655805	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 called NtSetContextThread to modify thread in remote process 304
Process injection	Process 2536 called NtSetContextThread to modify thread in remote process 292
NtSetContextThread Nov. 18, 2021, 7:46 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4389945 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000484 process_identifier: 304	1	0	0
NtSetContextThread Nov. 18, 2021, 8:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4389945 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000488 process_identifier: 292	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"
parent_process	wscript.exe				martian_process	cmd /c "C:\Users\test22\AppData\Roaming\kl\Goldll.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2404 resumed a thread in remote process 304
Process injection	Process 2536 resumed a thread in remote process 292
NtResumeThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x00000484 suspend_count: 1 process_identifier: 304	1	0	0
NtResumeThread Nov. 18, 2021, 8:34 a.m.	thread_handle: 0x00000488 suspend_count: 1 process_identifier: 292	1	0	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Nov. 18, 2021, 7:46 a.m.	ordinal: 0 function_address: 0x003fde1c function_name: wine_get_unix_file_name module: KERNEL32 module_address: 0x76860000		3221225785	0
LdrGetProcedureAddress Nov. 18, 2021, 8:34 a.m.	ordinal: 0 function_address: 0x0044dd8c function_name: wine_get_unix_file_name module: KERNEL32 module_address: 0x76860000		3221225785	0

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

MicroWorld-eScan	Trojan.GenericKD.38037847
K7AntiVirus	Trojan ( 0058a7861 )
K7GW	Trojan ( 0058a7861 )
CrowdStrike	win/malicious_confidence_60% (W)
Cyren	W32/MSIL_Troj.BTF.gen!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.ADLQ
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.38037847
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.GenericKD.38037847
DrWeb	Trojan.PackedNET.1102
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Agent
Webroot	W32.Trojan.Gen
Arcabit	Trojan.Generic.D2446957
AhnLab-V3	Malware/Win.Generic.C4773072
BitDefenderTheta	Gen:NN.ZemsilF.34266.Pm0@aa1a4O
ALYac	IL:Trojan.MSILZilla.10487
MAX	malware (ai score=100)
Malwarebytes	Spyware.TelegramBot
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.ADKN!tr
AVG	Win32:MalwareX-gen [Trj]

Executed a process and injected code into it, probably while unpacking (50 out of 76 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 18, 2021, 7:45 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2404	1	0
NtResumeThread Nov. 18, 2021, 7:45 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2404	1	0
NtResumeThread Nov. 18, 2021, 7:45 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2404	1	0
NtResumeThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 2404	1	0
CreateProcessInternalW Nov. 18, 2021, 7:46 a.m.	thread_identifier: 2728 thread_handle: 0x000003ac process_identifier: 2724 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\vbc.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b4	1	1
NtResumeThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 2404	1	0
NtResumeThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x0000040c suspend_count: 1 process_identifier: 2404	1	0
CreateProcessInternalW Nov. 18, 2021, 7:46 a.m.	thread_identifier: 2864 thread_handle: 0x00000470 process_identifier: 2860 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000488	1	1
CreateProcessInternalW Nov. 18, 2021, 7:46 a.m.	thread_identifier: 2912 thread_handle: 0x00000478 process_identifier: 2908 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jUtbYuWa" /XML "C:\Users\test22\AppData\Local\Temp\tmp9DE.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000484	1	1
CreateProcessInternalW Nov. 18, 2021, 7:46 a.m.	thread_identifier: 3012 thread_handle: 0x00000480 process_identifier: 3008 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000046c	1	1
NtGetContextThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x00000480	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 3008 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000046c		3221225496
CreateProcessInternalW Nov. 18, 2021, 7:46 a.m.	thread_identifier: 3048 thread_handle: 0x00000470 process_identifier: 3044 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000464	1	1
NtGetContextThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x00000470	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 3044 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000464		3221225496
CreateProcessInternalW Nov. 18, 2021, 7:46 a.m.	thread_identifier: 1588 thread_handle: 0x00000484 process_identifier: 304 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000478	1	1
NtGetContextThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x00000484	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:46 a.m.	process_identifier: 304 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000478	1	0
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ª@0îb.cîb.cîb.cZþßcüb.cZþÝcOb.cZþÜcðb.cçªcïb.cpÂécìb.cÕ<-bôb.cÕ<+bÔb.cÕ<*bÌb.cç½cûb.cîb/cÏc.cy<'b±b.c\|<Ñcïb.cy<,bïb.cRichîb.cPEL;Waà 9ü0@ÜäJPÄ8 l8´lXl@0\|.text `.rdatao0p$@@.dataì? @À.tls à¢@À.gfids0ð¤@@.rsrcäJL¨@@.relocÄ8P:ô@B base_address: 0x00400000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: base_address: 0x00401000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: base_address: 0x00453000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ¬tE°wEªtE..p¡F<¶F<¶F<¶F<¶F<¶F<¶F<¶F<¶F<¶Ft¡F@¶F@¶F@¶F@¶F@¶F@¶F@¶Fx¡Fÿÿÿÿ°wE¢F¢F¢F¢F¢Fx¡F0zE°{EEØ¡Fp§FCPSTPDT ¢Fà¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZp§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: base_address: 0x0046e000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: ÙôØ?iÝÝ?ÑÝ?Ùw?zÊ@t@G##ÈÝÞÍ(öÐõ??M- ,ÝWÝÖ±ßú»Þ»Þý »#»{\|QnÊã='¢t¨ÄªX¦-ûÅÁÍÞ¼ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: base_address: 0x00470000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: base_address: 0x00475000 process_identifier: 304 process_handle: 0x00000478	1	1
WriteProcessMemory Nov. 18, 2021, 7:46 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 304 process_handle: 0x00000478	1	1
NtSetContextThread Nov. 18, 2021, 7:46 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4389945 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000484 process_identifier: 304	1	0
NtResumeThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x00000484 suspend_count: 1 process_identifier: 304	1	0
NtResumeThread Nov. 18, 2021, 7:46 a.m.	thread_handle: 0x000004a0 suspend_count: 1 process_identifier: 2404	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2724	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2724	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x00000438 suspend_count: 1 process_identifier: 2724	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 2724	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2860	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2860	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 2860	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x000004ac suspend_count: 1 process_identifier: 2860	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 304	1	0
CreateProcessInternalW Nov. 18, 2021, 8:33 a.m.	thread_identifier: 2308 thread_handle: 0x0000029c process_identifier: 2304 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000290	1	1
CreateProcessInternalW Nov. 18, 2021, 8:33 a.m.	thread_identifier: 2168 thread_handle: 0x000002fc process_identifier: 2172 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\kl\Goldll.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000304	1	1
CreateProcessInternalW Nov. 18, 2021, 8:33 a.m.	thread_identifier: 2540 thread_handle: 0x00000084 process_identifier: 2536 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\kl\Goldll.exe track: 1 command_line: C:\Users\test22\AppData\Roaming\kl\Goldll.exe filepath_r: C:\Users\test22\AppData\Roaming\kl\Goldll.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread Nov. 18, 2021, 8:33 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread Nov. 18, 2021, 8:34 a.m.	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 2536	1	0
CreateProcessInternalW Nov. 18, 2021, 8:34 a.m.	thread_identifier: 2956 thread_handle: 0x000003b0 process_identifier: 2948 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\kl\Goldll.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b8	1	1
NtResumeThread Nov. 18, 2021, 8:34 a.m.	thread_handle: 0x000003bc suspend_count: 1 process_identifier: 2536	1	0
NtResumeThread Nov. 18, 2021, 8:34 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 2536	1	0
CreateProcessInternalW Nov. 18, 2021, 8:34 a.m.	thread_identifier: 2128 thread_handle: 0x00000478 process_identifier: 2196 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\jUtbYuWa.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000490	1	1

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All