Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 19, 2021, 4:55 p.m.	Nov. 19, 2021, 4:59 p.m.

Size	707.5KB
Type	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
MD5	`5fe6efedf5b16b05f59a0d5939a513b7`
SHA256	`57de84ac2faa2a05fc3e52fb79ae165e2825308fec4d86e30cc2c0c9984b089a`
CRC32	`89B79DF0`
ssdeep	`12288:L8GZC/4Ct57oWN26bWXU8J+kvtyQVw+imK0BXmIVCtCBuZzEZlfVSm5x2U:L8x/4CtRU6bmU8J+sgQVHiaXRVCY8Z4p`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

pm.exe "C:\Users\test22\AppData\Local\Temp\pm.exe"
2308

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 19, 2021, 4:47 p.m.			0	0
IsDebuggerPresent Nov. 19, 2021, 4:47 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 19, 2021, 4:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000050c3a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 19, 2021, 4:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000050c3a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Nov. 19, 2021, 4:48 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001cb1a9b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 19, 2021, 4:47 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 19, 2021, 4:48 p.m.	stacktrace: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x76dcf45d K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x76de3fe1 0x7fe935585b4 0x7fe935584fe 0x7fe93554912 0x7fe9354f7b4 0x7fe93551e2a 0x7fe9354463e 0x7fe93544ec8 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2bff713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2bff242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef2c4b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef2c4ad83 mscorlib+0x563c95 @ 0x7fef1ab3c95 mscorlib+0x486001 @ 0x7fef19d6001 mscorlib+0x524a6c @ 0x7fef1a74a6c 0x7fe93530afe mscorlib+0x4ef8a5 @ 0x7fef1a3f8a5 mscorlib+0x4ef609 @ 0x7fef1a3f609 mscorlib+0x4ef5c7 @ 0x7fef1a3f5c7 mscorlib+0x502d21 @ 0x7fef1a52d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2bff713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2bff242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef2bff30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef2dc6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef2ca6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef2ca6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef2ca6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef2ca6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef2dc6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef2d366ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76da652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x770fc521 exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8 exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d exception.instruction: mov qword ptr [r15 + rcx*8], rax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 259165 exception.address: 0x76dcf45d registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 470874640 registers.r11: 514 registers.r8: 470866616 registers.r9: 470866672 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1205534720 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 19, 2021, 4:48 p.m.

stacktrace:

K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d @ 0x76dcf45d
K32EnumProcessModules+0x11 K32EnumPageFilesA-0x19f kernel32+0x53fe1 @ 0x76de3fe1
0x7fe935585b4
0x7fe935584fe
0x7fe93554912
0x7fe9354f7b4
0x7fe93551e2a
0x7fe9354463e
0x7fe93544ec8
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2bff713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2bff242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef2c4b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef2c4ad83
mscorlib+0x563c95 @ 0x7fef1ab3c95
mscorlib+0x486001 @ 0x7fef19d6001
mscorlib+0x524a6c @ 0x7fef1a74a6c
0x7fe93530afe
mscorlib+0x4ef8a5 @ 0x7fef1a3f8a5
mscorlib+0x4ef609 @ 0x7fef1a3f609
mscorlib+0x4ef5c7 @ 0x7fef1a3f5c7
mscorlib+0x502d21 @ 0x7fef1a52d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef2bff713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef2bff242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef2bff30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef2dc6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef2ca6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef2ca6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef2ca6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef2ca6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef2dc6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef2d366ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76da652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x770fc521

exception.instruction_r: 49 89 04 cf eb 13 8b c8 ff 15 95 d7 05 00 8b c8
exception.symbol: K32InitializeProcessForWsWatch+0x16d K32EnumPageFilesW-0x333 kernel32+0x3f45d
exception.instruction: mov qword ptr [r15 + rcx*8], rax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 259165
exception.address: 0x76dcf45d
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 470874640
registers.r11: 514
registers.r8: 470866616
registers.r9: 470866672
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1205534720
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 71 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ab0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef324b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9340a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9341c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:47 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9341a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9340b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9342b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9345c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9342d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93402000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9341d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93531000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9353c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9353d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93544000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9341e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93545000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ae400', u'virtual_address': u'0x00002000', u'entropy': 7.6640588889118195, u'name': u'.text', u'virtual_size': u'0x000ae214'}

entropy

7.66405888891

description

A section with a high entropy has been found

entropy

0.98585572843

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 19, 2021, 4:47 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2632 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000260	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\winda

reg_value

"C:\Users\test22\AppData\Roaming\winda.exe"

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2308 manipulating memory of non-child process 2632
NtUnmapViewOfSection Nov. 19, 2021, 4:48 p.m.	base_address: 0x0000000140000000 region_size: 8786416697344 process_identifier: 2632 process_handle: 0x0000000000000260		-1073741799	0
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2632 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000260	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2308 injected into non-child 2632
WriteProcessMemory Nov. 19, 2021, 4:48 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd/Uâð"0: @ @@@ ÀÔ94¸ H.textP `.rsrcÔ9À:@@ base_address: 0x0000000140000000 process_identifier: 2632 process_handle: 0x0000000000000260	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2308 injected into non-child 2632
WriteProcessMemory Nov. 19, 2021, 4:48 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd/Uâð"0: @ @@@ ÀÔ94¸ H.textP `.rsrcÔ9À:@@ base_address: 0x0000000140000000 process_identifier: 2632 process_handle: 0x0000000000000260	1	1	0

Executed a process and injected code into it, probably while unpacking (9 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 19, 2021, 4:47 p.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 2308	1	0
NtResumeThread Nov. 19, 2021, 4:47 p.m.	thread_handle: 0x000000000000013c suspend_count: 1 process_identifier: 2308	1	0
NtResumeThread Nov. 19, 2021, 4:47 p.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 2308	1	0
NtResumeThread Nov. 19, 2021, 4:48 p.m.	thread_handle: 0x00000000000001fc suspend_count: 1 process_identifier: 2308	1	0
NtResumeThread Nov. 19, 2021, 4:48 p.m.	thread_handle: 0x0000000000000258 suspend_count: 1 process_identifier: 2308	1	0
CreateProcessInternalW Nov. 19, 2021, 4:48 p.m.	thread_identifier: 2636 thread_handle: 0x000000000000025c process_identifier: 2632 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\aspnet_compiler.exe filepath_r: stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 1 process_handle: 0x0000000000000260	1	1
NtUnmapViewOfSection Nov. 19, 2021, 4:48 p.m.	base_address: 0x0000000140000000 region_size: 8786416697344 process_identifier: 2632 process_handle: 0x0000000000000260		-1073741799
NtAllocateVirtualMemory Nov. 19, 2021, 4:48 p.m.	process_identifier: 2632 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000260	1	0
WriteProcessMemory Nov. 19, 2021, 4:48 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd/Uâð"0: @ @@@ ÀÔ94¸ H.textP `.rsrcÔ9À:@@ base_address: 0x0000000140000000 process_identifier: 2632 process_handle: 0x0000000000000260	1	1

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Lionic	Trojan.MSIL.Seraph.a!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47395334
FireEye	Trojan.GenericKD.47395334
ALYac	Trojan.GenericKD.47395334
CrowdStrike	win/malicious_confidence_80% (W)
Alibaba	TrojanDownloader:MSIL/Seraph.ca658c77
Arcabit	Trojan.Generic.D2D33206
ESET-NOD32	a variant of Generik.NMRIACD
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Generic-7113183-0
BitDefender	Trojan.GenericKD.47395334
Avast	Win64:MalwareX-gen [Trj]
Ad-Aware	Trojan.GenericKD.47395334
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.UMal.uzaae@0
DrWeb	Trojan.DownLoader43.64548
Emsisoft	Trojan.Crypt (A)
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1145355
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win64.Gen.sa
Microsoft	Trojan:MSIL/AgentTesla.LHE!MTB
GData	Trojan.GenericKD.47395334
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4771515
McAfee	Artemis!5FE6EFEDF5B1
MAX	malware (ai score=100)
VBA32	TrojanDownloader.MSIL.Seraph
TrendMicro-HouseCall	TROJ_FRS.0NA104KF21
Ikarus	Trojan.SuspectCRC
eGambit	Trojan.Generic
Fortinet	Malicious_Behavior.SB
AVG	Win64:MalwareX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

pm.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All