Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 18, 2022, 4:40 p.m.	Jan. 18, 2022, 4:43 p.m.

Size	651.3KB
Type	MS-DOS executable
MD5	`e5b9c0f6e09af4b902ea432a0ccf55e5`
SHA256	`32fac8f6e9640c74d825d75c1da4e37c85ede436f61e307c2e0e7e737fc3382f`
CRC32	`BAAD8749`
ssdeep	`12288:9eXoMXckaTROLIKXF4zphutfvYfICLkleU3c+if0OPCbXPc7bgAPxIM:9wkR+tX+VhynYQOkxs+ifFf+M`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file

9.exe "C:\Users\test22\AppData\Local\Temp\9.exe"
2312

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
37.46.135.6	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 18, 2022, 4:40 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (50 out of 240 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:40 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 4:41 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 18, 2022, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6030 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 4:40 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 18, 2022, 4:41 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.ctors
section	CODE

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	FLG
resource name	PIFF
resource name	UIFILE

One or more processes crashed (50 out of 317 events)

Time & API	Arguments	Status
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 8b 10 eb 02 8f 99 64 8f 00 eb 03 1b 93 e6 83 c4 exception.symbol: 9+0x141062 exception.instruction: mov edx, dword ptr [eax] exception.module: 9.exe exception.exception_code: 0xc0000005 exception.offset: 1314914 exception.address: 0x1351062 registers.esp: 2489028 registers.edi: 0 registers.eax: 0 registers.ebp: 2489048 registers.edx: 20254720 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 8b 00 eb 03 6b 2c f7 64 8f 00 eb 01 6b 83 c4 04 exception.symbol: 9+0x141e57 exception.instruction: mov eax, dword ptr [eax] exception.module: 9.exe exception.exception_code: 0xc0000005 exception.offset: 1318487 exception.address: 0x1351e57 registers.esp: 2488996 registers.edi: 0 registers.eax: 0 registers.ebp: 2489048 registers.edx: 4294901775 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: exception.instruction_r: cd 01 40 40 eb 04 15 33 31 a4 85 c0 eb 02 8e 6d exception.symbol: 9+0x157efe exception.instruction: int 1 exception.module: 9.exe exception.exception_code: 0xc0000005 exception.offset: 1408766 exception.address: 0x1367efe registers.esp: 2488988 registers.edi: 20348528 registers.eax: 0 registers.ebp: 309083 registers.edx: 0 registers.ebx: 20256271 registers.esi: 20256271 registers.ecx: 20348764	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: exception.instruction_r: f7 f2 eb 02 c0 c8 eb 02 82 a5 90 eb 01 1b e9 5c exception.symbol: 9+0x1438c4 exception.instruction: div edx exception.module: 9.exe exception.exception_code: 0xc0000094 exception.offset: 1325252 exception.address: 0x13538c4 registers.esp: 2488996 registers.edi: 20339932 registers.eax: 0 registers.ebp: 314401 registers.edx: 0 registers.ebx: 4128768 registers.esi: 20256271 registers.ecx: 63238	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: exception.instruction_r: 8b 0a eb 03 21 90 57 e9 a3 00 00 00 eb 03 db be exception.symbol: 9+0x14383d exception.instruction: mov ecx, dword ptr [edx] exception.module: 9.exe exception.exception_code: 0xc0000005 exception.offset: 1325117 exception.address: 0x135383d registers.esp: 2488996 registers.edi: 7143424 registers.eax: 4050935971 registers.ebp: 314401 registers.edx: 0 registers.ebx: 4128768 registers.esi: 7143600 registers.ecx: 0	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x14b436 @ 0x135b436 9+0x15834e @ 0x136834e 9+0x143b74 @ 0x1353b74 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x4001000a exception.offset: 46887 exception.address: 0x766fb727 registers.esp: 2488540 registers.edi: 4135244 registers.eax: 2488540 registers.ebp: 2488620 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7150088 registers.ecx: 4	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6d3ad4 9+0x143b74 @ 0x1353b74 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff 33 c0 33 d2 39 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6d3c44 registers.esp: 2488636 registers.edi: 4147928 registers.eax: 1 registers.ebp: 2488648 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 2020557398	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x143b74 @ 0x1353b74 exception.instruction_r: 8b 00 90 90 f8 eb 03 6b a0 e1 73 48 eb 05 69 e9 exception.instruction: mov eax, dword ptr [eax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6d3b04 registers.esp: 2488660 registers.edi: 4147928 registers.eax: 0 registers.ebp: 2488976 registers.edx: 2 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 2130563072	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x143b74 @ 0x1353b74 exception.instruction_r: 90 f8 eb 03 6b a0 e1 73 48 eb 05 69 e9 65 f4 9e exception.instruction: nop exception.exception_code: 0x80000004 exception.symbol: exception.address: 0x6d3b07 registers.esp: 2488660 registers.edi: 4147928 registers.eax: 0 registers.ebp: 2488976 registers.edx: 2 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 2130563072	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x143b74 @ 0x1353b74 exception.instruction_r: 0f 0b eb 04 d9 4c fd 33 0f 0b eb 04 8d 3d 0c 3a exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6d3bba registers.esp: 2488660 registers.edi: 4150548 registers.eax: 0 registers.ebp: 2488976 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 235	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x772f6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x772f6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x73ff482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x772c0143 9+0x143b74 @ 0x1353b74 exception.instruction_r: f7 f0 eb 04 15 64 9e 22 eb 03 08 8d ea eb 05 d8 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6d3d39 registers.esp: 2486868 registers.edi: 0 registers.eax: 0 registers.ebp: 2486884 registers.edx: 20264332 registers.ebx: 7158993 registers.esi: 0 registers.ecx: 2487536	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x143b74 @ 0x1353b74 exception.instruction_r: cd 01 40 40 eb 03 19 8c 06 85 c0 eb 04 f1 8d ce exception.instruction: int 1 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6d3bb4 registers.esp: 2488660 registers.edi: 4151416 registers.eax: 0 registers.ebp: 2488976 registers.edx: 7158930 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 20264332	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x143b74 @ 0x1353b74 exception.instruction_r: cc eb 04 bb 5a f8 eb 33 c9 78 f4 8b 43 70 eb 02 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x6d3bc8 registers.esp: 2488656 registers.edi: 4152012 registers.eax: 0 registers.ebp: 2488976 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 2488656 registers.ecx: 4	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: exception.instruction_r: 8b 0a eb 02 a1 f0 e9 3f fd ff ff eb 01 be e9 7f exception.symbol: 9+0x1462a4 exception.instruction: mov ecx, dword ptr [edx] exception.module: 9.exe exception.exception_code: 0xc0000005 exception.offset: 1335972 exception.address: 0x13562a4 registers.esp: 2488996 registers.edi: 4184432 registers.eax: 92 registers.ebp: 320453 registers.edx: 0 registers.ebx: 4128768 registers.esi: 7143600 registers.ecx: 0	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x1464a5 @ 0x13564a5 exception.instruction_r: f7 f1 eb 01 39 e9 79 f4 ff ff eb 02 08 24 81 fa exception.symbol: 9+0x146503 exception.instruction: div ecx exception.module: 9.exe exception.exception_code: 0xc0000094 exception.offset: 1336579 exception.address: 0x1356503 registers.esp: 2488884 registers.edi: 4184432 registers.eax: 173066869 registers.ebp: 2488976 registers.edx: 20273217 registers.ebx: 7143600 registers.esi: 18939904 registers.ecx: 0	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: exception.instruction_r: 0f 0b eb 03 b9 72 42 0f 0b eb 02 8a 91 e9 c1 08 exception.symbol: 9+0x145d8f exception.instruction: ud2 exception.module: 9.exe exception.exception_code: 0xc000001d exception.offset: 1334671 exception.address: 0x1355d8f registers.esp: 2488996 registers.edi: 4296241 registers.eax: 4296241 registers.ebp: 320453 registers.edx: 2130566132 registers.ebx: 4128768 registers.esi: 7143600 registers.ecx: 465240064	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f b7 53 06 eb 03 b8 91 00 c1 e2 10 eb 05 ea 12 exception.instruction: movzx edx, word ptr [ebx + 6] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6dfd30 registers.esp: 2488644 registers.edi: 7143600 registers.eax: 0 registers.ebp: 2488672 registers.edx: 2488664 registers.ebx: 12079256 registers.esi: 370176 registers.ecx: 208	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6dfd30 9+0x14716a @ 0x135716a exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff 33 c0 33 d2 39 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dfea0 registers.esp: 2488636 registers.edi: 4324277 registers.eax: 1 registers.ebp: 2488648 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 2020557398	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x14716a @ 0x135716a exception.instruction_r: 8b 00 90 90 f8 eb 03 6b a0 e1 73 48 eb 05 69 e9 exception.instruction: mov eax, dword ptr [eax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6dfd60 registers.esp: 2488660 registers.edi: 4324277 registers.eax: 0 registers.ebp: 2488976 registers.edx: 2 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 2130563072	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x14716a @ 0x135716a exception.instruction_r: 90 f8 eb 03 6b a0 e1 73 48 eb 05 69 e9 65 f4 9e exception.instruction: nop exception.exception_code: 0x80000004 exception.symbol: exception.address: 0x6dfd63 registers.esp: 2488660 registers.edi: 4324277 registers.eax: 0 registers.ebp: 2488976 registers.edx: 2 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 2130563072	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x14716a @ 0x135716a exception.instruction_r: cd 68 eb 03 28 8e 54 66 3d 86 f3 eb 04 0d c9 72 exception.instruction: int 0x68 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6e0fc7 registers.esp: 2488660 registers.edi: 4330485 registers.eax: 17152 registers.ebp: 2488976 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 234	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b eb 04 d9 4c fd 33 0f 0b eb 04 8d 3d 0c 3a exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6e1b62 registers.esp: 2488660 registers.edi: 4336177 registers.eax: 0 registers.ebp: 2488976 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 235	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x772f6ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x772f6a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x73ff482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x772c0143 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 04 15 64 9e 22 eb 03 08 8d ea eb 05 d8 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6e1ce1 registers.esp: 2486868 registers.edi: 0 registers.eax: 0 registers.ebp: 2486884 registers.edx: 20264332 registers.ebx: 7216249 registers.esi: 0 registers.ecx: 2487536	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb b7 eb 01 12 eb 01 b5 33 d2 72 9a exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6e1cdc registers.esp: 2488648 registers.edi: 4337013 registers.eax: 0 registers.ebp: 2488672 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 7215864 registers.ecx: 10	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 8b c2 eb 05 19 a3 ff 85 9e 55 8b 60 f9 72 04 18 exception.instruction: mov eax, edx exception.exception_code: 0x80000004 exception.symbol: exception.address: 0x6e1d69 registers.esp: 2488648 registers.edi: 4337013 registers.eax: 0 registers.ebp: 2488672 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 7215864 registers.ecx: 10	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: cc eb 05 c6 d8 c6 7d 90 5e 5b 8b e5 5d c3 eb 05 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x6e1cb0 registers.esp: 2488648 registers.edi: 4337013 registers.eax: 0 registers.ebp: 2488672 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 7215864 registers.ecx: 10	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 02 22 25 eb 03 30 b3 3e cc eb 05 c6 d8 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6e1ca5 registers.esp: 2488648 registers.edi: 4337013 registers.eax: 0 registers.ebp: 2488672 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 7215864 registers.ecx: 10	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: cc eb 05 c6 d8 c6 7d 90 5e 5b 8b e5 5d c3 eb 05 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x6e1cb0 registers.esp: 2488648 registers.edi: 4337769 registers.eax: 20264333 registers.ebp: 2488672 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 7215864 registers.ecx: 10	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 02 22 25 eb 03 30 b3 3e cc eb 05 c6 d8 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6e1ca5 registers.esp: 2488648 registers.edi: 4337769 registers.eax: 0 registers.ebp: 2488672 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 7215864 registers.ecx: 10	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: exception.instruction_r: cc eb 04 68 e8 e6 0b 3c 04 eb 03 c0 92 ec 75 52 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x6e1b77 registers.esp: 2488656 registers.edi: 4338541 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 20264332 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 84	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 9+0x14716a @ 0x135716a exception.instruction_r: cd 01 40 40 eb 03 19 8c 06 85 c0 eb 04 f1 8d ce exception.instruction: int 1 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6e1b5c registers.esp: 2488660 registers.edi: 4339105 registers.eax: 0 registers.ebp: 2488976 registers.edx: 7216186 registers.ebx: 7143600 registers.esi: 370176 registers.ecx: 20264332	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e73a4 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2488300 registers.edi: 4359653 registers.eax: 0 registers.ebp: 2488660 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e7488 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2488280 registers.edi: 7238816 registers.eax: 0 registers.ebp: 2488640 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e92a1 0x6e914b 0x6e8ac5 0x6e811b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2487944 registers.edi: 4363069 registers.eax: 0 registers.ebp: 2488304 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9312 0x6e914b 0x6e8ac5 0x6e811b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2487944 registers.edi: 4363069 registers.eax: 0 registers.ebp: 2488304 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e73a4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 17167880 registers.edi: 1988735230 registers.eax: 0 registers.ebp: 17168240 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e7488 0x6e18ac BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 17167860 registers.edi: 7238816 registers.eax: 0 registers.ebp: 17168220 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: cc eb 05 c6 a4 b0 0b 19 eb 03 a1 0c 2c eb 05 ea exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0x6e18ea registers.esp: 17168260 registers.edi: 1988735230 registers.eax: 0 registers.ebp: 17168320 registers.edx: 7146960 registers.ebx: 7143600 registers.esi: 17168260 registers.ecx: 0	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9338 0x6e8d76 0x6e8b08 0x6e811b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2487640 registers.edi: 2488174 registers.eax: 0 registers.ebp: 2488000 registers.edx: 2487788 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9447 0x6e8d76 0x6e8b08 0x6e811b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2487640 registers.edi: 2488174 registers.eax: 0 registers.ebp: 2488000 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9338 0x6e8cd6 0x6e8b6a 0x6e811b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2487636 registers.edi: 2488138 registers.eax: 0 registers.ebp: 2487996 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9447 0x6e8cd6 0x6e8b6a 0x6e811b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2487636 registers.edi: 2488138 registers.eax: 0 registers.ebp: 2487996 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9740 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2488300 registers.edi: 4368817 registers.eax: 0 registers.ebp: 2488660 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6ea573 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2488216 registers.edi: 4368817 registers.eax: 0 registers.ebp: 2488576 registers.edx: 7247680 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6ea923 0x6e9e25 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2487808 registers.edi: 4368817 registers.eax: 0 registers.ebp: 2488168 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6e9f86 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2488220 registers.edi: 4368817 registers.eax: 0 registers.ebp: 2488580 registers.edx: 7204318 registers.ebx: 7143600 registers.esi: 7204318 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6ebca6 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2487992 registers.edi: 19342725 registers.eax: 0 registers.ebp: 2488352 registers.edx: 0 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6ec4a3 0x6f091b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 02 86 5a eb 05 6b 97 c0 e2 2b f7 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6de1ea registers.esp: 2487712 registers.edi: 19342725 registers.eax: 0 registers.ebp: 2488072 registers.edx: 438955175 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6dfb18 0x6f091b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: f7 f0 eb 01 84 eb 1f eb 04 3d 05 09 30 eb 05 f6 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x6de1f9 registers.esp: 2487704 registers.edi: 19342725 registers.eax: 0 registers.ebp: 2488064 registers.edx: 465240064 registers.ebx: 7143600 registers.esi: 7201096 registers.ecx: 7143600	1
__exception__ Jan. 18, 2022, 4:40 p.m.	stacktrace: 0x6dfc30 0x6ec4f9 0x6f091b 9+0x15834e @ 0x136834e 9+0x14716a @ 0x135716a exception.instruction_r: 0f 0b 0f 0b eb 03 e8 c4 47 eb 01 e9 f7 f0 eb 02 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x6dee81 registers.esp: 2487696 registers.edi: 19342725 registers.eax: 0 registers.ebp: 2488056 registers.edx: 7204318 registers.ebx: 4284996940 registers.esi: 7204318 registers.ecx: 7143600	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 53 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 274432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 282624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x772c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7734f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 262144 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 229376 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01212000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f42000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 331776 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 299008 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f50000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 651264 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x749d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 258048 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x766f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7381b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73832000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1282048 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75271000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 614400 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74dd0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00935000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0093b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00937000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7374a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736cf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ce1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ce4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00916000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00917000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 155648 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75191000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

9.exe tried to sleep 137 seconds, actually delayed analysis time by 137 seconds

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW Jan. 18, 2022, 4:40 p.m.	snapshot_handle: 0x0000009c process_name: mobsync.exe process_identifier: 1976	1	1
Process32NextW Jan. 18, 2022, 4:40 p.m.	snapshot_handle: 0x0000009c process_name: cmd.exe process_identifier: 2244	1	1
Process32NextW Jan. 18, 2022, 4:40 p.m.	snapshot_handle: 0x0000009c process_name: conhost.exe process_identifier: 2252	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 18, 2022, 4:40 p.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x008c0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0004753e', u'virtual_address': u'0x0003d000', u'entropy': 7.482253886475065, u'name': u'.rsrc', u'virtual_size': u'0x001038b0'}

entropy

7.48225388648

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000179e0', u'virtual_address': u'0x00141000', u'entropy': 7.997070090338376, u'name': u'.idata', u'virtual_size': u'0x00018000'}

entropy

7.99707009034

description

A section with a high entropy has been found

entropy

0.99868517691

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

9.exe

Communicates with host for which no DNS query was performed (1 event)

host

37.46.135.6

Checks for the presence of known devices from debuggers and forensic tools (2 events)

file	\??\SICE
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (2 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowW Jan. 18, 2022, 4:40 p.m.	class_name: WinDbgFrameClass window_name:		0	0
FindWindowExW Jan. 18, 2022, 4:40 p.m.	class_name: OLLYDBG child_after_hwnd: 0x00000000 parent_hwnd: 0x00000000 window_name: OllyDBg	1	196652	0

Detects VirtualBox through the presence of a device (1 event)

file	\??\VBoxGuest

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Stealer.l!c
MicroWorld-eScan	Trojan.GenericKD.38567719
FireEye	Generic.mg.e5b9c0f6e09af4b9
McAfee	Artemis!E5B9C0F6E09A
Cylance	Unsafe
Sangfor	Spyware.Win32.Stealer.azbh
Alibaba	TrojanSpy:Win32/Stealer.1a0c85f4
BitDefenderTheta	Gen:NN.ZexaF.34160.Oq3@aSVXVxai
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.BMY
Kaspersky	Trojan-Spy.Win32.Stealer.azbh
BitDefender	Trojan.GenericKD.38567719
Avast	FileRepMetagen [Malware]
Ad-Aware	Trojan.GenericKD.38567719
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
GData	Trojan.GenericKD.38567719
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan.Occamy
Malwarebytes	Spyware.PasswordStealer
APEX	Malicious
Rising	Malware.Heuristic!ET#83% (RDMK:cmRtazr4JR2M61Jgkp5zbcADyLWw)
MAX	malware (ai score=86)
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_70% (W)

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

37.46.135.6:63166

9.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All