Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 18, 2021, 7:47 a.m.	Nov. 18, 2021, 8:26 a.m.

Size	185.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0198c5a612317a06f11abbe95294408e`
SHA256	`11ce64503803fa5f190a0ad45ca4a7906685ef9db939ef75f50a548944d8664e`
CRC32	`07D89025`
ssdeep	`3072:7NmwVdUzOLggn5R0lfOghEw9v1LdlrZMAM/sZu537k2Vy92GvBIvT3KyO+YV1pwD:7NtVdTl6hEw9v1LdlrZMAM/sZu537k2n`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

9370_1636985686_7616.exe "C:\Users\test22\AppData\Local\Temp\9370_1636985686_7616.exe"
2328

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.129.233

IP Address	Status	Action
162.159.135.233	Active	Moloch
164.124.101.2	Active	Moloch
93.115.20.139	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 162.159.135.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49162 162.159.135.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 18, 2021, 7:48 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 18, 2021, 7:47 a.m.			0	0
IsDebuggerPresent Nov. 18, 2021, 7:47 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (39 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012d5ef0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000013149c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000013149c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000013149c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000001314a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000001314a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f95c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f76c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f76c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f76c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f76c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7b90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000012f7c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001af6a390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001af6a390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 18, 2021, 7:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001af6a400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 18, 2021, 7:47 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	I!&\x17 \x08%+
section

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 18, 2021, 7:48 a.m.	stacktrace: 0x7fe93587c5a 0x7fe935874c9 0x7fe93587375 0x7fe935865f2 0x7fe93586043 0x7fe935858d6 0x7fe9357d6d7 0x7fe9357b6d3 0x7fe9357b1a9 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2c0f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2c0f242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef2c5b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef2c5ad83 mscorlib+0x563bfc @ 0x7fef1ac3bfc mscorlib+0x486001 @ 0x7fef19e6001 0x7fe9357b05f mscorlib+0x4ef8a5 @ 0x7fef1a4f8a5 mscorlib+0x4ef609 @ 0x7fef1a4f609 mscorlib+0x4ef5c7 @ 0x7fef1a4f5c7 mscorlib+0xd5159d @ 0x7fef22b159d CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2c0f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2c0f242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef2c0f30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef2dd6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef2cb6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef2cb6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef2cb6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef2cb6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef2dd6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef2d466ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76da652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x770fc521 exception.instruction_r: 48 8b 40 08 48 8b 40 08 48 89 45 08 90 48 8b 45 exception.instruction: mov rax, qword ptr [rax + 8] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe93587c5a registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 472907456 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 18, 2021, 7:48 a.m.

stacktrace:

0x7fe93587c5a
0x7fe935874c9
0x7fe93587375
0x7fe935865f2
0x7fe93586043
0x7fe935858d6
0x7fe9357d6d7
0x7fe9357b6d3
0x7fe9357b1a9
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2c0f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2c0f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef2c5b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef2c5ad83
mscorlib+0x563bfc @ 0x7fef1ac3bfc
mscorlib+0x486001 @ 0x7fef19e6001
0x7fe9357b05f
mscorlib+0x4ef8a5 @ 0x7fef1a4f8a5
mscorlib+0x4ef609 @ 0x7fef1a4f609
mscorlib+0x4ef5c7 @ 0x7fef1a4f5c7
mscorlib+0xd5159d @ 0x7fef22b159d
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2c0f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2c0f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef2c0f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef2dd6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef2cb6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef2cb6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef2cb6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef2cb6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef2dd6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef2d466ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76da652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x770fc521

exception.instruction_r: 48 8b 40 08 48 8b 40 08 48 89 45 08 90 48 8b 45
exception.instruction: mov rax, qword ptr [rax + 8]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe93587c5a
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 472907456
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://cdn.discordapp.com/attachments/907388240229716010/909788097527545866/45756734124235.exe

Performs some HTTP requests (1 event)

request

GET https://cdn.discordapp.com/attachments/907388240229716010/909788097527545866/45756734124235.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef325b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bc4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9344a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9345c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93571000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93526000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 57344 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000013a2000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93573000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93574000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9344b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93442000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9344c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9346b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9345a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9349c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9346d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9349d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 7:47 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (33 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\
file	C:\Users\test22\AppData\Local\Chromium\User Data\

Executes one or more WMI queries (1 event)

wmi	SELECT * FROM Win32_DiskDrive

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 18, 2021, 7:47 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000d600', u'virtual_address': u'0x00002000', u'entropy': 7.996611056324781, u'name': u'I!&\\x17\r\\x08%+', u'virtual_size': u'0x0000d448'}

entropy

7.99661105632

description

A section with a high entropy has been found

entropy

0.290760869565

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

93.115.20.139

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Lionic	Trojan.MSIL.Stealer.l!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen3.5604
Cynet	Malicious (score: 100)
FireEye	Generic.mg.0198c5a612317a06
ALYac	Trojan.GenericKD.47413490
Cylance	Unsafe
K7AntiVirus	Trojan ( 0058a5c81 )
Alibaba	Trojan:MSIL/GenKryptik.fb09ecc9
K7GW	Trojan ( 0058a5c81 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34266.lu0@aeT4DAi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FNKY
TrendMicro-HouseCall	TROJ_FRS.0NA103KH21
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.47413490
MicroWorld-eScan	Trojan.GenericKD.47413490
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.47413490
Emsisoft	Trojan.GenericKD.47413490 (B)
Comodo	TrojWare.Win32.UMal.gtten@0
TrendMicro	TROJ_FRS.0NA103KH21
McAfee-GW-Edition	BehavesLike.Win32.Drixed.ch
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Krypt
eGambit	Unsafe.AI_Score_99%
Avira	HEUR/AGEN.1137140
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Sabsik.dd!n
Microsoft	Trojan:Win32/Casdet!rfn
GData	Trojan.GenericKD.47413490
McAfee	RDN/Generic.rp
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.Downloader
APEX	Malicious
Yandex	Trojan.GenKryptik!FPveqaU5xbw
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/GenKryptik.FNKY!tr
Webroot	W32.Malware.Gen
AVG	Win32:Trojan-gen
Cybereason	malicious.da2271
Panda	Trj/GdSda.A

9370_1636985686_7616.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All