Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 28, 2022, 4:58 p.m.	Oct. 28, 2022, 5:10 p.m.

Size	273.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8f89c4cd81384874cea3378488944245`
SHA256	`d24dd6cd68f406d083ebc0690537254dcaabfd26ef4987dd6c2cc99c29be277e`
CRC32	`6B9F9001`
ssdeep	`6144:5C1jvMtY4JotTOrgs0GVzu6oz4HdCVdKrL42oJ8L:5C1j8Y4JGOkAlLozedCi/p`
PDB Path	C:\Users\Administrator\Documents\CryptoObfuscator_Output\HHkPoJhH.pdb
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

HHkPoJhH.exe "C:\Users\test22\AppData\Local\Temp\HHkPoJhH.exe"
1952
- Powershell.exe "Powershell" Copy-Item 'C:\Users\test22\AppData\Local\Temp\HHkPoJhH.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyJHpstem.exe'
  2628
- RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2684
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
chinagov.duckdns.org	A 198.20.177.169	198.20.177.169

IP Address	Status	Action
164.124.101.2	Active	Moloch
198.20.177.169	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 28, 2022, 4:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2022, 4:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2022, 4:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2022, 4:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 28, 2022, 4:59 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2022, 4:59 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 28, 2022, 4:58 p.m.			0	0
IsDebuggerPresent Oct. 28, 2022, 4:58 p.m.			0	0
IsDebuggerPresent Oct. 28, 2022, 4:58 p.m.			0	0
IsDebuggerPresent Oct. 28, 2022, 4:59 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (45 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f1328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f13a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f13a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb4f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ebeb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eb738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eba78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eba78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eba78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2022, 4:59 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x002eba78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Documents\CryptoObfuscator_Output\HHkPoJhH.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 28, 2022, 4:58 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

chinagov.duckdns.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 162 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00485000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00791000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00792000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:58 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00793000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00794000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00795000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ee1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04eec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04eed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04eee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02531000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"Powershell" Copy-Item 'C:\Users\test22\AppData\Local\Temp\HHkPoJhH.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyJHpstem.exe'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Oct. 28, 2022, 4:59 p.m.	thread_identifier: 2632 thread_handle: 0x00000240 process_identifier: 2628 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "Powershell" Copy-Item 'C:\Users\test22\AppData\Local\Temp\HHkPoJhH.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyJHpstem.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000244	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0003bc00', u'virtual_address': u'0x00002000', u'entropy': 7.910964685988994, u'name': u'.text', u'virtual_size': u'0x0003bbc8'}

entropy

7.91096468599

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00008400', u'virtual_address': u'0x00040000', u'entropy': 6.845806752545993, u'name': u'.rsrc', u'virtual_size': u'0x000083a4'}

entropy

6.84580675255

description

A section with a high entropy has been found

entropy

0.998165137615

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 28, 2022, 4:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 28, 2022, 4:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://microsoft.com/

Yara rule detected in process memory (18 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: c7e45e550d183f01b5c9d6894d333f43e8389145
buffer	Buffer with sha1: 56c02de0f15d1b88fbbfdbbcc42147fd0d88da94

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2684 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268	1	0	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $OOhã.°.°.°È!Y° .°E± .°È![° .°E±.°,èk° .°,èh°.°" °.°E± .°E±.°.°á.°W±p.°Wù° .°W± .°Rich.°PELnÙbàrä¤m@ @PÌ,@p,pÄÊ.textqr `.rdataOPv@@.dataQàÆ@À.rsrcp,@.Ì@@.relocÄpú@B.bss@@ base_address: 0x00400000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: Æ@è@÷@@@$@3@U@d@y@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PáAPáAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ¼ÁAd base_address: 0x0041e000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: 2N},8[ cÃÅØ2QÏs:g«AØ iÕéiëñË§±'.n¯.^¢$X:w¿=[UÂB#¬XDT³ì;xÞWÇ[Ù¡ÅXû¬Q/°^XôÈ%/OÕU"'Iç¬!_i¾aþ§E_-Sô³Îºç(wJOrK%·Ú base_address: 0x00559000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2684 process_handle: 0x00000268	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $OOhã.°.°.°È!Y° .°E± .°È![° .°E±.°,èk° .°,èh°.°" °.°E± .°E±.°.°á.°W±p.°Wù° .°W± .°Rich.°PELnÙbàrä¤m@ @PÌ,@p,pÄÊ.textqr `.rdataOPv@@.dataQàÆ@À.rsrcp,@.Ì@@.relocÄpú@B.bss@@ base_address: 0x00400000 process_identifier: 2684 process_handle: 0x00000268	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1952 called NtSetContextThread to modify thread in remote process 2684
NtSetContextThread Oct. 28, 2022, 4:59 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4222372 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2684	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1952 resumed a thread in remote process 2684
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2684	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

198.20.177.169:5202

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 28, 2022, 4:58 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1952	1	0
NtResumeThread Oct. 28, 2022, 4:58 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1952	1	0
NtResumeThread Oct. 28, 2022, 4:58 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1952	1	0
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 1952	1	0
CreateProcessInternalW Oct. 28, 2022, 4:59 p.m.	thread_identifier: 2632 thread_handle: 0x00000240 process_identifier: 2628 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "Powershell" Copy-Item 'C:\Users\test22\AppData\Local\Temp\HHkPoJhH.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyJHpstem.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000244	1	1
CreateProcessInternalW Oct. 28, 2022, 4:59 p.m.	thread_identifier: 2688 thread_handle: 0x00000264 process_identifier: 2684 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000268	1	1
NtGetContextThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x00000264	1	0
NtAllocateVirtualMemory Oct. 28, 2022, 4:59 p.m.	process_identifier: 2684 region_size: 1417216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268	1	0
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $OOhã.°.°.°È!Y° .°E± .°È![° .°E±.°,èk° .°,èh°.°" °.°E± .°E±.°.°á.°W±p.°Wù° .°W± .°Rich.°PELnÙbàrä¤m@ @PÌ,@p,pÄÊ.textqr `.rdataOPv@@.dataQàÆ@À.rsrcp,@.Ì@@.relocÄpú@B.bss@@ base_address: 0x00400000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: base_address: 0x00401000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: base_address: 0x00419000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: Æ@è@÷@@@$@3@U@d@y@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(PáAPáAUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃ¼ÁAd base_address: 0x0041e000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: base_address: 0x00554000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: base_address: 0x00557000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: 2N},8[ cÃÅØ2QÏs:g«AØ iÕéiëñË§±'.n¯.^¢$X:w¿=[UÂB#¬XDT³ì;xÞWÇ[Ù¡ÅXû¬Q/°^XôÈ%/OÕU"'Iç¬!_i¾aþ§E_-Sô³Îºç(wJOrK%·Ú base_address: 0x00559000 process_identifier: 2684 process_handle: 0x00000268	1	1
WriteProcessMemory Oct. 28, 2022, 4:59 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2684 process_handle: 0x00000268	1	1
NtSetContextThread Oct. 28, 2022, 4:59 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4222372 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2684	1	0
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2684	1	0
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Oct. 28, 2022, 4:59 p.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 2628	1	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Heracles.4!c
DrWeb	Trojan.Inject4.45703
MicroWorld-eScan	Trojan.GenericKD.63021698
FireEye	Generic.mg.8f89c4cd81384874
ALYac	Trojan.GenericKD.63021698
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005976671 )
Alibaba	Trojan:Win32/runner.ali1000123
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D3C1A282
BitDefenderTheta	Gen:NN.ZemsilF.34726.rm0@a4PSWSe
Cyren	W32/ABRisk.OEOX-5188
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AGFG
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.63021698
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-Spy.Stealer.Simw
Ad-Aware	Trojan.GenericKD.63021698
VIPRE	Trojan.GenericKD.63021698
TrendMicro	TROJ_GEN.R049C0PJO22
McAfee-GW-Edition	RDN/Real Protect-LS
Emsisoft	Trojan.GenericKD.63021698 (B)
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/Dropper.Gen
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASMalwS.3E3F
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	TrojanDropper:O97M/CrimsonRAT.YA!MTB
GData	Trojan.GenericKD.63021698
Cynet	Malicious (score: 99)
Acronis	suspicious
McAfee	Artemis!8F89C4CD8138
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TROJ_GEN.R049C0PJO22
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:YL48Z2cB2/c6thxoVQHPsA)
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AGFG!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.054c4b
Panda	Trj/Chgt.AA

HHkPoJhH.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All