Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 17, 2022, 9:13 a.m.	June 17, 2022, 9:15 a.m.

Size	79.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`05f3c1eab22d9fe95d0ef200b1c70a9f`
SHA256	`a8eec26e578c921511a099417bc3f2564c8f85fdb765d24c010949e4194797e7`
CRC32	`A330AD63`
ssdeep	`1536:aKs1B4GZjzQwK5WW7VCn6Ky7FAmu3wtBUniymeq07sZPSTlkOzPqBR:9s1ve5BV0WUniyimyL`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2312
- powershell.exe "powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;
  2400

Name	Response	Post-Analysis Lookup
www.uplooder.net	A 144.76.120.25	144.76.120.25

IP Address	Status	Action
144.76.120.25	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49163 -> 144.76.120.25:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49163 144.76.120.25:443	C=LV, L=Riga, O=GoGetSSL, CN=GoGetSSL RSA DV CA	CN=uplooder.net	9f:34:64:54:51:09:f3:62:0d:6d:9e:86:2e:5c:d3:7d:9e:9a:d7:ff

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameA June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 17, 2022, 9:13 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 17, 2022, 9:13 a.m.			0	0
IsDebuggerPresent June 17, 2022, 9:13 a.m.			0	0
IsDebuggerPresent June 17, 2022, 9:13 a.m.			0	0
IsDebuggerPresent June 17, 2022, 9:13 a.m.			0	0
IsDebuggerPresent June 17, 2022, 9:13 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2e48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2d88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2d88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2d88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2488 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2d88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2d88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2d88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f26c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2bc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 17, 2022, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002f2bc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 17, 2022, 9:13 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://www.uplooder.net/img/image/94/365c557dbb0fa37ee848c74b3f23fa8a/999-Pmmugalz.png

Performs some HTTP requests (1 event)

request

GET https://www.uplooder.net/img/image/94/365c557dbb0fa37ee848c74b3f23fa8a/999-Pmmugalz.png

Allocates read-write-execute memory (usually to unpack itself) (50 out of 145 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73942000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02360000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x706e1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01efa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x706e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ef2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02371000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02372000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01efb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0240c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2022, 9:13 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 17, 2022, 9:13 a.m.	thread_identifier: 2404 thread_handle: 0x0000020c process_identifier: 2400 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10; filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000218	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 17, 2022, 9:13 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 17, 2022, 9:13 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetectNet.01
MicroWorld-eScan	IL:Trojan.MSILZilla.20681
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.19c2bd
Arcabit	IL:Trojan.MSILZilla.D50C9
BitDefenderTheta	Gen:NN.ZemsilF.34742.em0@a0eMXLf
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MEW
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	IL:Trojan.MSILZilla.20681
Avast	PWSX-gen [Trj]
Ad-Aware	IL:Trojan.MSILZilla.20681
Emsisoft	IL:Trojan.MSILZilla.20681 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.lh
FireEye	Generic.mg.05f3c1eab22d9fe9
Sophos	Mal/Generic-S
APEX	Malicious
Avira	HEUR/AGEN.1248320
MAX	malware (ai score=87)
Microsoft	Trojan:MSIL/AgentTesla.ZAT!MTB
GData	IL:Trojan.MSILZilla.20681
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!05F3C1EAB22D
Ikarus	Trojan-Downloader.MSIL.Agent
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.MES!tr.dldr
AVG	PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All