Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 10, 2022, 7:18 p.m.	Oct. 10, 2022, 7:27 p.m.

Size	880.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`53460de37325b4979177f832ae51f9de`
SHA256	`bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1`
CRC32	`8475EEF1`
ssdeep	`24576:7stUx5NK+HjoSIIJ2thqogNSNOKt5apf7xesN7:gtIS+dJgRkSNO0Qpow`
Yara	UPX_Zero - UPX packed file IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library anti_vm_detect - Possibly employs anti-virtualization techniques PE_Header_Zero - PE File Signature Network_Downloader - File Downloader Malicious_Packer_Zero - Malicious Packer

Server_se.exe "C:\Users\test22\AppData\Local\Temp\Server_se.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
106.52.15.123	Active	Moloch
121.4.98.100	Active	Moloch
47.93.60.63	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 10, 2022, 7:19 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sedata

One or more processes crashed (32 events)

Time & API	Arguments	Status
__exception__ Oct. 10, 2022, 7:18 p.m.	stacktrace: server_se+0x111f47 @ 0x511f47 server_se+0x123928 @ 0x523928 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: eb 09 f5 64 fa 9d 6c dd 11 90 13 c3 e9 68 ff ff exception.symbol: server_se+0x69a22 exception.instruction: jmp 0x469a2d exception.module: Server_se.exe exception.exception_code: 0x80000003 exception.offset: 432674 exception.address: 0x469a22 registers.esp: 1638008 registers.edi: 0 registers.eax: 0 registers.ebp: 1638052 registers.edx: 582600 registers.ebx: 5 registers.esi: 10016560 registers.ecx: 10016560	1
__exception__ Oct. 10, 2022, 7:18 p.m.	stacktrace: 0x203 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 1636988 registers.edi: 4859999 registers.eax: 4579350 registers.ebp: 1637020 registers.edx: 4026283453 registers.ebx: 4579350 registers.esi: 1637256 registers.ecx: 2496494940	1
__exception__ Oct. 10, 2022, 7:18 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579350 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579350 registers.esi: 40041528 registers.ecx: 2496494940	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579336 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579336 registers.esi: 40041528 registers.ecx: 1628607778	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579336 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579336 registers.esi: 40041528 registers.ecx: 1628607778	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579336 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579336 registers.esi: 40041528 registers.ecx: 1628607778	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579336 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579336 registers.esi: 40041528 registers.ecx: 1628607778	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:19 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579332 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579332 registers.esi: 40041528 registers.ecx: 3717167931	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579328 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579328 registers.esi: 40041528 registers.ecx: 3895752595	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579328 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579328 registers.esi: 40041528 registers.ecx: 3895752595	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579328 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579328 registers.esi: 40041528 registers.ecx: 3895752595	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579328 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579328 registers.esi: 40041528 registers.ecx: 3895752595	1
__exception__ Oct. 10, 2022, 7:20 p.m.	stacktrace: 0x207 exception.instruction_r: 8d 04 85 00 00 00 00 f8 e9 ea 06 00 00 c1 0f bb exception.symbol: server_se+0x9f317 exception.instruction: lea eax, dword ptr [eax*4] exception.module: Server_se.exe exception.exception_code: 0x80000004 exception.offset: 652055 exception.address: 0x49f317 registers.esp: 40041260 registers.edi: 4859999 registers.eax: 4579328 registers.ebp: 40041292 registers.edx: 4026283453 registers.ebx: 4579328 registers.esi: 40041528 registers.ecx: 3895752595	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://47.93.60.63:8000/exploror.exe

Performs some HTTP requests (1 event)

request

GET http://47.93.60.63:8000/exploror.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 4854 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 region_size: 1576960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 65536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 region_size: 294912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x759aa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Oct. 10, 2022, 7:19 p.m.	total_number_of_free_bytes: 13319041024 free_bytes_available: 13319041024 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Foreign language identified in PE resource (5 events)

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00127588

size

0x00000128

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00127588

size

0x00000128

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00127588

size

0x00000128

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x001276d4

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x001276d4

size

0x00000014

Creates executable files on the filesystem (2 events)

file	C:\windowss64\computer.exe
file	C:\Program Files\Windows NT\system.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA Oct. 10, 2022, 7:18 p.m.	service_start_name: start_type: 2 password: display_name: Gkayqm iequyakc filepath: C:\Program Files (x86)\Ecigfam.exe service_name: Rswuir nbyzxkyy filepath_r: C:\Program Files (x86)\Ecigfam.exe desired_access: 983551 service_handle: 0x009a2240 error_control: 1 service_type: 272 service_manager_handle: 0x009a2358	1	10101312	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 events)

Time & API	Arguments	Status	Return
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: mobsync.exe process_identifier: 2276	1	1
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: pw.exe process_identifier: 2320	1	1
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: taskhost.exe process_identifier: 2372	1	1
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Server_se.exe process_identifier: 2548	1	1
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: UI0Detect.exe process_identifier: 2856	1	1
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 2884	1	1
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 10, 2022, 7:18 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 45056 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00012800', u'virtual_address': u'0x00001000', u'entropy': 7.996551566938196, u'name': u'.text', u'virtual_size': u'0x0005d000'}

entropy

7.99655156694

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000c7a00', u'virtual_address': u'0x0005e000', u'entropy': 7.787506448701848, u'name': u'.sedata', u'virtual_size': u'0x000c8000'}

entropy

7.7875064487

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001000', u'virtual_address': u'0x00128000', u'entropy': 7.981780604916885, u'name': u'.sedata', u'virtual_size': u'0x00001000'}

entropy

7.98178060492

description

A section with a high entropy has been found

entropy

0.996588971006

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 80 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0
Process32NextW Oct. 10, 2022, 7:19 p.m.	snapshot_handle: 0x000003f8 process_name: Ecigfam.exe process_identifier: 6750313		0	0

Communicates with host for which no DNS query was performed (3 events)

host	106.52.15.123
host	121.4.98.100
host	47.93.60.63

Installs itself for autorun at Windows startup (1 event)

service_name

Rswuir nbyzxkyy

service_path

C:\Program Files (x86)\Ecigfam.exe

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.lIx9
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Symmi.75598
ALYac	Gen:Variant.Symmi.75598
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005239691 )
Alibaba	Packed:Win32/NoobyProtect.06d96a2d
K7GW	Trojan ( 005239691 )
Cybereason	malicious.37325b
Cyren	W32/ABRisk.YHQG-3684
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.NoobyProtect.M suspicious
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Farfli.cejj
BitDefender	Gen:Variant.Symmi.75598
NANO-Antivirus	Trojan.Win32.Farfli.jsxwrl
Avast	Win32:MalwareX-gen [Trj]
Tencent	Win32.Backdoor.Farfli.Osmw
Ad-Aware	Gen:Variant.Symmi.75598
Emsisoft	Gen:Variant.Symmi.75598 (B)
Comodo	TrojWare.Win32.Amtar.KNB@4wlm66
DrWeb	BackDoor.Siggen2.3334
VIPRE	Gen:Variant.Symmi.75598
TrendMicro	TROJ_GEN.R002C0DJ722
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.53460de37325b497
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
GData	Win32.Packed.NoobyProtect.B
Avira	HEUR/AGEN.1237416
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASBOL.C6B4
Kingsoft	Win32.Hack.Undef.(kcloud)
Gridinsoft	Trojan.Heur!.030100A1
Arcabit	Trojan.Symmi.D1274E
Microsoft	Trojan:Win32/Tnega!MSR
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R514498
Acronis	suspicious
McAfee	RDN/Generic BackDoor
Malwarebytes	Malware.AI.1868818684
TrendMicro-HouseCall	TROJ_GEN.R002C0DJ722
Rising	Backdoor.Farfli!8.B4 (TFE:5:TpoaHBHYiZI)
Ikarus	PUA.NoobyProtect

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 events)

dead_host	192.168.56.101:49169
dead_host	192.168.56.101:49166
dead_host	106.52.15.123:80
dead_host	192.168.56.101:49163

Server_se.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All