Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 13, 2022, 5:30 p.m.	June 13, 2022, 5:32 p.m.

Size	688.7KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f890317fa129658a359bb44e3d68316c`
SHA256	`c25d71266bb1f81af0184439ed01cc36d50714fffb84cfb7a717a8491dd96678`
CRC32	`41DCD0D9`
ssdeep	`12288:fplH22qla5w/yXbxBjMdVjPEyyMCKpIyurKsIuX:rH0MW/IbxBjozEhMs1X`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) hide_executable_file - Hide executable file PE_Header_Zero - PE File Signature

donexx.exe "C:\Users\test22\AppData\Local\Temp\donexx.exe"
2408
- powershell.exe "powershell" Start-Sleep -Seconds 19
  2500
- cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 45
  2728
  - timeout.exe timeout 45
    2800
- MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2276
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.162.228.171	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 13, 2022, 5:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 13, 2022, 5:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 13, 2022, 5:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 13, 2022, 5:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 13, 2022, 5:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 13, 2022, 5:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 13, 2022, 5:30 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 13, 2022, 5:30 p.m.			0	0
IsDebuggerPresent June 13, 2022, 5:30 p.m.			0	0
IsDebuggerPresent June 13, 2022, 5:30 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 13, 2022, 5:31 p.m.	buffer: Waiting for 45 console_handle: 0x00000007	1	1	0
WriteConsoleW June 13, 2022, 5:31 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (43 events)

Time & API	Arguments	Status	Return
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00671260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006712e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004010e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401ba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401ba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401ba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004012a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004012a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004012a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004012a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004012a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004012a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401ba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401ba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401ba8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004014e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00400ea8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 13, 2022, 5:30 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00401b28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 13, 2022, 5:30 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 13, 2022, 5:31 p.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7689b37e 0x20bc6c0 0x20bc5f4 0x20ba866 0x20b7ec6 0x20b7cfb 0x20b7c4e 0x20b761d DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73942652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x739c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x739c1737 mscorlib+0x2d3711 @ 0x722a3711 mscorlib+0x308f2d @ 0x722d8f2d mscorlib+0x2cb060 @ 0x7229b060 0x4f9899b 0x4f97ad8 0x4f80b03 0x83acd6 0x83a31d 0x83a20e 0x83a180 0x83a11b 0x837dfe 0x835a40 0x835956 0x4f9bf99 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73942652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x739c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x739c1737 mscorlib+0x2d3711 @ 0x722a3711 mscorlib+0x308f2d @ 0x722d8f2d mscorlib+0x3133fd @ 0x722e33fd mscorlib+0x9873b1 @ 0x729573b1 0x8301a1 0x830087 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73942652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73952e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73a074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73a07610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73a91dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73a91e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73a91f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73a9416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73fef5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74277f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74274de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x7689b479 registers.esp: 4110992 registers.edi: 1987043272 registers.eax: 1310720 registers.ebp: 4111196 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1	0	0
__exception__ June 13, 2022, 5:31 p.m.	stacktrace: msbuild+0x3738 @ 0x403738 msbuild+0x12a34 @ 0x412a34 msbuild+0x1570a @ 0x41570a msbuild+0x5ea7 @ 0x405ea7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7 exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118 exception.instruction: movzx eax, word ptr [ecx] exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 209176 exception.address: 0x76893118 registers.esp: 3274240 registers.edi: 3274372 registers.eax: 3274264 registers.ebp: 3274280 registers.edx: 43581440 registers.ebx: 0 registers.esi: 3274536 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 13, 2022, 5:31 p.m.

stacktrace:

K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7689b37e
0x20bc6c0
0x20bc5f4
0x20ba866
0x20b7ec6
0x20b7cfb
0x20b7c4e
0x20b761d
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73942652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x739c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x739c1737
mscorlib+0x2d3711 @ 0x722a3711
mscorlib+0x308f2d @ 0x722d8f2d
mscorlib+0x2cb060 @ 0x7229b060
0x4f9899b
0x4f97ad8
0x4f80b03
0x83acd6
0x83a31d
0x83a20e
0x83a180
0x83a11b
0x837dfe
0x835a40
0x835956
0x4f9bf99
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73942652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x739c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x739c1737
mscorlib+0x2d3711 @ 0x722a3711
mscorlib+0x308f2d @ 0x722d8f2d
mscorlib+0x3133fd @ 0x722e33fd
mscorlib+0x9873b1 @ 0x729573b1
0x8301a1
0x830087
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73942652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73952e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73a074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73a07610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73a91dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73a91e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73a91f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73a9416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73fef5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74277f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74274de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7689b479
registers.esp: 4110992
registers.edi: 1987043272
registers.eax: 1310720
registers.ebp: 4111196
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0

__exception__

June 13, 2022, 5:31 p.m.

stacktrace:

msbuild+0x3738 @ 0x403738
msbuild+0x12a34 @ 0x412a34
msbuild+0x1570a @ 0x41570a
msbuild+0x5ea7 @ 0x405ea7
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7
exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118
exception.instruction: movzx eax, word ptr [ecx]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 209176
exception.address: 0x76893118
registers.esp: 3274240
registers.edi: 3274372
registers.eax: 3274264
registers.ebp: 3274280
registers.edx: 43581440
registers.ebx: 0
registers.esi: 3274536
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 218 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73942000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02150000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00831000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00832000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00836000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0204f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00839000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0083a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f93000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f95000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f98000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f99000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 13, 2022, 5:30 p.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 13, 2022, 5:32 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 10236317696 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\cmd.exe" /c timeout 45
cmdline	"powershell" Start-Sleep -Seconds 19

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 13, 2022, 5:30 p.m.	thread_identifier: 2504 thread_handle: 0x00000208 process_identifier: 2500 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Start-Sleep -Seconds 19 filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000214	1	1	0
ShellExecuteExW June 13, 2022, 5:31 p.m.	show_type: 0 filepath_r: cmd parameters: /c timeout 45 filepath: cmd	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0009e800', u'virtual_address': u'0x00002000', u'entropy': 7.081884103490883, u'name': u'.text', u'virtual_size': u'0x0009e6f8'}

entropy

7.08188410349

description

A section with a high entropy has been found

entropy

0.970160673298

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 13, 2022, 5:31 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 13, 2022, 5:30 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (18 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero

Communicates with host for which no DNS query was performed (1 event)

host

45.162.228.171

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 13, 2022, 5:31 p.m.	process_identifier: 2276 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000390	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Mhkii

reg_value

"C:\Users\test22\AppData\Roaming\Kdvdwz\Mhkii.exe"

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: 2n®´µñ¹4c¢5IêürS!¦²#¾ßË=¡û6y¦?0ã½ÑZ_Ì]öÏ$ªbccèaæ?dLe@måÀöv>&ô6ÈqýÜ z\|èçðãÆiµùº´³8-´8U]Ð6#DKÌ¦ ä¾4öcLOfpJo¯8¿rì7ûg$=÷4ÎTU<ìì´ÜÊ!tÌµ1V@ base_address: 0x0055d000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2276 process_handle: 0x00000390	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2276 process_handle: 0x00000390	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2408 called NtSetContextThread to modify thread in remote process 2276
NtSetContextThread June 13, 2022, 5:31 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 2276	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2408 resumed a thread in remote process 2276
NtResumeThread June 13, 2022, 5:31 p.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2276	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

45.162.228.171:26112

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2408	1	0
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2408	1	0
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2408	1	0
CreateProcessInternalW June 13, 2022, 5:30 p.m.	thread_identifier: 2504 thread_handle: 0x00000208 process_identifier: 2500 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Start-Sleep -Seconds 19 filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000214	1	1
CreateProcessInternalW June 13, 2022, 5:31 p.m.	thread_identifier: 2732 thread_handle: 0x0000038c process_identifier: 2728 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c timeout 45 filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000394	1	1
CreateProcessInternalW June 13, 2022, 5:31 p.m.	thread_identifier: 2292 thread_handle: 0x00000214 process_identifier: 2276 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000390	1	1
NtGetContextThread June 13, 2022, 5:31 p.m.	thread_handle: 0x00000214	1	0
NtAllocateVirtualMemory June 13, 2022, 5:31 p.m.	process_identifier: 2276 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000390	1	0
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: base_address: 0x00401000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: base_address: 0x00417000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: base_address: 0x0041c000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: base_address: 0x0055b000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: 2n®´µñ¹4c¢5IêürS!¦²#¾ßË=¡û6y¦?0ã½ÑZ_Ì]öÏ$ªbccèaæ?dLe@måÀöv>&ô6ÈqýÜ z\|èçðãÆiµùº´³8-´8U]Ð6#DKÌ¦ ä¾4öcLOfpJo¯8¿rì7ûg$=÷4ÎTU<ìì´ÜÊ!tÌµ1V@ base_address: 0x0055d000 process_identifier: 2276 process_handle: 0x00000390	1	1
WriteProcessMemory June 13, 2022, 5:31 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2276 process_handle: 0x00000390	1	1
NtSetContextThread June 13, 2022, 5:31 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000214 process_identifier: 2276	1	0
NtResumeThread June 13, 2022, 5:31 p.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2276	1	0
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2500	1	0
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2500	1	0
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2500	1	0
NtResumeThread June 13, 2022, 5:30 p.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2500	1	0
CreateProcessInternalW June 13, 2022, 5:31 p.m.	thread_identifier: 2804 thread_handle: 0x00000084 process_identifier: 2800 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 45 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.MSIL.Androm.1
FireEye	Generic.mg.f890317fa129658a
McAfee	AgentTesla-FDIG!F890317FA129
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
Arcabit	Trojan.MSIL.Androm.1
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MDK
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	VHO:Backdoor.MSIL.Androm.gen
BitDefender	Gen:Heur.MSIL.Androm.1
Avast	PWSX-gen [Trj]
Ad-Aware	Gen:Heur.MSIL.Androm.1
Emsisoft	Gen:Heur.MSIL.Androm.1 (B)
DrWeb	Trojan.Inject4.30942
McAfee-GW-Edition	AgentTesla-FDIG!F890317FA129
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	VHO:Backdoor.MSIL.Androm.gen
GData	Gen:Heur.MSIL.Androm.1
BitDefenderTheta	Gen:NN.ZemsilF.34712.Rm3@a8Qkluo
MAX	malware (ai score=82)
Malwarebytes	Malware.AI.4140744471
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.300983.susgen
AVG	PWSX-gen [Trj]
Cybereason	malicious.fa1296

donexx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All