Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 18, 2022, 10:31 a.m.	Jan. 18, 2022, 10:37 a.m.

Size	132.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`017f6137bb09d75043e4e11c378b8857`
SHA256	`7364c7f19b20f1228b008b1cb6731afeafda3515c96c7f14b20a8bfe915f5b4e`
CRC32	`4F59CC66`
ssdeep	`3072:76cJv/k1CP4k8cJXGimEWlzgLa8KEWJ7Ox0H/BRwjpCKWYhrK21Jv8PUOMHGvg2/:BqwPhkYUax1Lb+M2yfyq`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

vbbnh.exe "C:\Users\test22\AppData\Local\Temp\vbbnh.exe"
2764

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 18, 2022, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:31 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:31 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 18, 2022, 10:31 a.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 10:31 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 18, 2022, 10:31 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Jan. 18, 2022, 10:31 a.m.	stacktrace: 0x7fe94a3f645 0x7fe94a23c36 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef40ef713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef40ef242 CoUninitializeEE+0x4f7a7 GetMetaDataInternalInterface-0x27f75 clr+0x5294b @ 0x7fef40f294b CoUninitializeEE+0x4f782 GetMetaDataInternalInterface-0x27f9a clr+0x52926 @ 0x7fef40f2926 CoUninitializeEE+0x4fece GetMetaDataInternalInterface-0x2784e clr+0x53072 @ 0x7fef40f3072 CoUninitializeEE+0x4fdae GetMetaDataInternalInterface-0x2796e clr+0x52f52 @ 0x7fef40f2f52 CoUninitializeEE+0x4f67f GetMetaDataInternalInterface-0x2809d clr+0x52823 @ 0x7fef40f2823 DestroyAssemblyConfigCookie+0x19986 PreBindAssembly-0x7eca clr+0xfaf0a @ 0x7fef419af0a CoUninitializeEE+0x4cd27 GetMetaDataInternalInterface-0x2a9f5 clr+0x4fecb @ 0x7fef40efecb DllRegisterServerInternal-0xcc6 clr+0x24da @ 0x7fef40a24da CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef40ef713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef40ef242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef40ef30b _CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef428721c _CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef4287976 _CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef4287870 _CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef42873e6 _CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef428733e _CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef4283ed4 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef57b74e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef5855b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76f9652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7748c521 exception.instruction_r: 80 38 00 48 8b 4d 48 e8 5f 75 3f 5e 48 89 85 d0 exception.instruction: cmp byte ptr [rax], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe94a3f645 registers.r14: 0 registers.r15: 0 registers.rcx: 41363544 registers.rsi: 0 registers.r10: 8789995520024 registers.rbx: 0 registers.rsp: 3865024 registers.r11: 3853600 registers.r8: 8791598533877 registers.r9: 1 registers.rdx: 3862480 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Jan. 18, 2022, 10:31 a.m.

stacktrace:

0x7fe94a3f645
0x7fe94a23c36
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef40ef713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef40ef242
CoUninitializeEE+0x4f7a7 GetMetaDataInternalInterface-0x27f75 clr+0x5294b @ 0x7fef40f294b
CoUninitializeEE+0x4f782 GetMetaDataInternalInterface-0x27f9a clr+0x52926 @ 0x7fef40f2926
CoUninitializeEE+0x4fece GetMetaDataInternalInterface-0x2784e clr+0x53072 @ 0x7fef40f3072
CoUninitializeEE+0x4fdae GetMetaDataInternalInterface-0x2796e clr+0x52f52 @ 0x7fef40f2f52
CoUninitializeEE+0x4f67f GetMetaDataInternalInterface-0x2809d clr+0x52823 @ 0x7fef40f2823
DestroyAssemblyConfigCookie+0x19986 PreBindAssembly-0x7eca clr+0xfaf0a @ 0x7fef419af0a
CoUninitializeEE+0x4cd27 GetMetaDataInternalInterface-0x2a9f5 clr+0x4fecb @ 0x7fef40efecb
DllRegisterServerInternal-0xcc6 clr+0x24da @ 0x7fef40a24da
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef40ef713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef40ef242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef40ef30b
_CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef428721c
_CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef4287976
_CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef4287870
_CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef42873e6
_CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef428733e
_CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef4283ed4
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef57b74e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef5855b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76f9652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7748c521

exception.instruction_r: 80 38 00 48 8b 4d 48 e8 5f 75 3f 5e 48 89 85 d0
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe94a3f645
registers.r14: 0
registers.r15: 0
registers.rcx: 41363544
registers.rsi: 0
registers.r10: 8789995520024
registers.rbx: 0
registers.rsp: 3865024
registers.r11: 3853600
registers.r8: 8791598533877
registers.r9: 1
registers.rdx: 3862480
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 63 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000940000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef473b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe948ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe948fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9499c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe949c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe949a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe948eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe948fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9490b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9493c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9490d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe948e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef29e6000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe948fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:31 a.m.	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 18, 2022, 10:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Tedy.229
FireEye	Generic.mg.017f6137bb09d750
McAfee	Artemis!017F6137BB09
Malwarebytes	Trojan.BitCoinMiner
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005459a31 )
Alibaba	Trojan:MSIL/Witch.0edd91a2
K7GW	Trojan ( 005459a31 )
Cybereason	malicious.40f105
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Small.FU
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Witch.gen
BitDefender	Gen:Variant.Ser.Tedy.229
Avast	Win64:TrojanX-gen [Trj]
Ad-Aware	Gen:Variant.Ser.Tedy.229
Sophos	Mal/Generic-S
DrWeb	Trojan.Siggen16.33615
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Ser.Tedy.229 (B)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_95%
Avira	TR/Small.mmuuq
Gridinsoft	Trojan.Win64.Generic.dd!n
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Ser.Tedy.229
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.TrojanX-gen.C4909255
ALYac	Gen:Variant.Ser.Tedy.229
MAX	malware (ai score=88)
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DAF22
Rising	Trojan.Generic/MSIL@AI.98 (RDM.MSIL:p1UqyBWMY+OvwZ/qmVOzcA)
Ikarus	Trojan.MSIL.Small
Fortinet	MSIL/Small.FU!tr
AVG	Win64:TrojanX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)

vbbnh.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All