Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 18, 2021, 7:47 a.m.	Nov. 18, 2021, 8:37 a.m.

Size	374.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0dcbd79d3ef702f1a33ae9fef6fdef06`
SHA256	`a16db45d226a3024f53575ed9417e74b63cdbe016dd464ee93a5dc8b18996e71`
CRC32	`A06E12B1`
ssdeep	`6144:TNv9xCxRO+XfDLe+tbP+mZ4zKJ28LURta+B4GHExWIucyRwqWa1WRfs5qN9rVfmF:TN1kxRF7LxZ+3zKJ28LU54ARNcyRPWv0`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description)

at.exe "C:\Users\test22\AppData\Local\Temp\at.exe"
2412
- at.exe "C:\Users\test22\AppData\Local\Temp\at.exe"
  2840
  - dw20.exe dw20.exe -x -s 524
    2936

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.5.212.11	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 18, 2021, 7:47 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:35 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 8:35 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 18, 2021, 8:35 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 70 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00781000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00921000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00783000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00788000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00789000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739b1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739b2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00463000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 8:35 a.m.	process_identifier: 2840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005ce00', u'virtual_address': u'0x00002000', u'entropy': 7.899632352399547, u'name': u'.text', u'virtual_size': u'0x0005cc4c'}

entropy

7.8996323524

description

A section with a high entropy has been found

entropy

0.993315508021

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 18, 2021, 7:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Nov. 18, 2021, 8:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (10 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	Run a KeyLogger	rule	KeyLogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Terminates another process (4 events)

Time & API	Arguments	Status
NtTerminateProcess Nov. 18, 2021, 7:47 a.m.	status_code: 0xffffffff process_identifier: 2760 process_handle: 0x00000238
NtTerminateProcess Nov. 18, 2021, 7:47 a.m.	status_code: 0xffffffff process_identifier: 2760 process_handle: 0x00000238	1
NtTerminateProcess Nov. 18, 2021, 7:47 a.m.	status_code: 0xffffffff process_identifier: 2804 process_handle: 0x00000244
NtTerminateProcess Nov. 18, 2021, 7:47 a.m.	status_code: 0xffffffff process_identifier: 2804 process_handle: 0x00000244	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Users\test22\AppData\Local\Temp\at.exe

Communicates with host for which no DNS query was performed (1 event)

host

194.5.212.11

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2760 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e0		3221225496
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2804 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c		3221225496
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2840 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2412 manipulating memory of non-child process 2760
Process injection	Process 2412 manipulating memory of non-child process 2804
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2760 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e0	3221225496	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2804 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c	3221225496	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELHÓaàV>u @ À@ìtO H.textDU V `.rsrc X@@.reloc \@B base_address: 0x00400000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: 0HXÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x+InternalNameVlxdsCzYXHjbwsWTPoPssBhxjQqNDNEDRvcWjs.exe(LegalCopyright +OriginalFilenameVlxdsCzYXHjbwsWTPoPssBhxjQqNDNEDRvcWjs.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 base_address: 0x00438000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: p@5 base_address: 0x0043a000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2840 process_handle: 0x00000240	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELHÓaàV>u @ À@ìtO H.textDU V `.rsrc X@@.reloc \@B base_address: 0x00400000 process_identifier: 2840 process_handle: 0x00000240	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2412 called NtSetContextThread to modify thread in remote process 2840
NtSetContextThread Nov. 18, 2021, 7:47 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4420926 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000244 process_identifier: 2840	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2412 resumed a thread in remote process 2840
NtResumeThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2840	1	0	0

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2412	1	0
NtResumeThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2412	1	0
CreateProcessInternalW Nov. 18, 2021, 7:47 a.m.	thread_identifier: 2764 thread_handle: 0x000001e4 process_identifier: 2760 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\at.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\at.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001e0	1	1
NtGetContextThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x000001e4	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2760 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e0		3221225496
CreateProcessInternalW Nov. 18, 2021, 7:47 a.m.	thread_identifier: 2808 thread_handle: 0x00000238 process_identifier: 2804 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\at.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\at.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000023c	1	1
NtGetContextThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x00000238	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2804 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000023c		3221225496
CreateProcessInternalW Nov. 18, 2021, 7:47 a.m.	thread_identifier: 2844 thread_handle: 0x00000244 process_identifier: 2840 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\at.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\at.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x00000244	1	0
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2840 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELHÓaàV>u @ À@ìtO H.textDU V `.rsrc X@@.reloc \@B base_address: 0x00400000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: base_address: 0x00402000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: 0HXÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x+InternalNameVlxdsCzYXHjbwsWTPoPssBhxjQqNDNEDRvcWjs.exe(LegalCopyright +OriginalFilenameVlxdsCzYXHjbwsWTPoPssBhxjQqNDNEDRvcWjs.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 base_address: 0x00438000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: p@5 base_address: 0x0043a000 process_identifier: 2840 process_handle: 0x00000240	1	1
WriteProcessMemory Nov. 18, 2021, 7:47 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2840 process_handle: 0x00000240	1	1
NtSetContextThread Nov. 18, 2021, 7:47 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4420926 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000244 process_identifier: 2840	1	0
NtResumeThread Nov. 18, 2021, 7:47 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2840	1	0
NtResumeThread Nov. 18, 2021, 8:35 a.m.	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2840	1	0
NtResumeThread Nov. 18, 2021, 8:35 a.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2840	1	0
CreateProcessInternalW Nov. 18, 2021, 8:35 a.m.	thread_identifier: 2940 thread_handle: 0x00000234 process_identifier: 2936 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe track: 1 command_line: dw20.exe -x -s 524 filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\\dw20.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000230	1	1
NtResumeThread Nov. 18, 2021, 8:35 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2936	1	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Lionic	Trojan.MSIL.Taskun.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.1102
MicroWorld-eScan	IL:Trojan.MSILZilla.10500
FireEye	Generic.mg.0dcbd79d3ef702f1
McAfee	RDN/Generic.grp
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/MSIL_Troj.BTG.gen!Eldorado
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/Kryptik.ADLU
TrendMicro-HouseCall	TROJ_GEN.R002C0DKG21
Paloalto	generic.ml
BitDefender	IL:Trojan.MSILZilla.10500
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	IL:Trojan.MSILZilla.10500
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R002C0DKG21
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
SentinelOne	Static AI - Malicious PE
Emsisoft	IL:Trojan.MSILZilla.10500 (B)
Ikarus	Trojan.MSIL.Agent
Webroot	W32.Trojan.Gen
Avira	TR/Tesla.zxtwd
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:MSIL/AgentTesla.LJD!MTB
GData	MSIL.Trojan.PSE.M6ZDP
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.AgentTesla.C4773491
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack.PNG.Generic
APEX	Malicious
MAX	malware (ai score=99)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Injector.VTU!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.d3ef70
Panda	Trj/GdSda.A

at.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All