Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 21, 2022, 9:59 a.m.	Dec. 21, 2022, 10:12 a.m.

Size	886.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c32bb2d4bbff0a1584d8fe1ff09a2d4e`
SHA256	`5cf08a64c8bddc68665dad7e028a4fe97ebb70d208fba0c83d83af83f38427a2`
CRC32	`08D645BB`
ssdeep	`12288:UBMPr1QL67I2t2KNMzsGVKpVlUEaekKmMxtIZRi6NOIj3P7FLh7NU/YA2ygQtvnE:Bv/Nzr6dKbxtIZQ6hzFFN5A2YM2RL77`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

HBN.exe "C:\Users\test22\AppData\Local\Temp\HBN.exe"
1460

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 21, 2022, 9:59 a.m.			0	0
IsDebuggerPresent Dec. 21, 2022, 9:59 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 21, 2022, 9:59 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (33 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 9:59 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b6f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x000db400', u'virtual_address': u'0x00002000', u'entropy': 7.933323755745886, u'name': u'.text', u'virtual_size': u'0x000db3b4'}

entropy

7.93332375575

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00002000', u'virtual_address': u'0x000de000', u'entropy': 7.167254455295613, u'name': u'.rsrc', u'virtual_size': u'0x00001e94'}

entropy

7.1672544553

description

A section with a high entropy has been found

entropy

0.999435347261

description

Overall entropy of this PE file is high

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 2616 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 manipulating memory of non-child process 2616
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 2616 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c	1	0	0

Potential code injection by writing to the memory of another process (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 injected into non-child 2616
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâoâÏÑâ«ÒãÏÑâ«Ôã<ÏÑâ«Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑâ³ØãgÏÑâ³.âÏÑâ³ÓãÏÑâRichÏÑâPELï5ucàF.)`@ð»ð`J°´9À8T ø@`¸.textÛDF `.rdatat`vJ@@.data,\àÀ@À.tls @Î@À.gfids0PÐ@@.rsrcJ`LÔ@@.reloc´9°: @B base_address: 0x00400000 process_identifier: 2616 process_handle: 0x0000024c	1	1	0
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ \|¥E¨Ez¥E..páFLöFLöFLöFLöFLöFLöFLöFLöFLöFtáFPöFPöFPöFPöFPöFPöFPöFxáFÿÿÿÿ¨EâFâFâFâFâFxáF«E¬EÈºEØáFpçFCPSTPDT âFàâFÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpçFþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨3XF¯4AdFU7ApFt4AfE.?AVtype_info@@fE.?AVbad_alloc@std@@fE.?AVbad_array_new_length@std@@fE.?AVlogic_error@std@@fE.?AVlength_error@std@@fE.?AVout_of_range@std@@fE.?AV_Facet_base@std@@fE.?AV_Locimp@locale@std@@fE.?AVfacet@locale@std@@fE.?AU_Crt_new_delete@std@@fE.?AVcodecvt_base@std@@fE.?AUctype_base@std@@fE.?AV?$ctype@D@std@@fE.?AV?$codecvt@DDU_Mbstatet@@@std@@fE.?AVbad_exception@std@@fE.HfE.?AVfailure@ios_base@std@@fE.?AVruntime_error@std@@fE.?AVsystem_error@std@@fE.?AVbad_cast@std@@fE.?AV_System_error@std@@fE.?AVexception@std@@ base_address: 0x0046e000 process_identifier: 2616 process_handle: 0x0000024c	1	1	0
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: base_address: 0x00474000 process_identifier: 2616 process_handle: 0x0000024c	1	1	0
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: F+>¿Ù>'>ÉÃ>zÆw7w ZÞYÎÎ½Î_//>>dccáNãÝpÙ4¥ï¥ïÀW~Z¦ª~«Aºüêæí3ôöòFd©¤6; b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x00475000 process_identifier: 2616 process_handle: 0x0000024c	1	1	0
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2616 process_handle: 0x0000024c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 injected into non-child 2616
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâoâÏÑâ«ÒãÏÑâ«Ôã<ÏÑâ«Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑâ³ØãgÏÑâ³.âÏÑâ³ÓãÏÑâRichÏÑâPELï5ucàF.)`@ð»ð`J°´9À8T ø@`¸.textÛDF `.rdatat`vJ@@.data,\àÀ@À.tls @Î@À.gfids0PÐ@@.rsrcJ`LÔ@@.reloc´9°: @B base_address: 0x00400000 process_identifier: 2616 process_handle: 0x0000024c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 called NtSetContextThread to modify thread in remote process 2616
NtSetContextThread Dec. 21, 2022, 10 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4401454 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000248 process_identifier: 2616	1	0	0

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread Dec. 21, 2022, 9:59 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Dec. 21, 2022, 9:59 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Dec. 21, 2022, 9:59 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread Dec. 21, 2022, 10 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 1460	1	0
CreateProcessInternalW Dec. 21, 2022, 10 a.m.	thread_identifier: 2620 thread_handle: 0x00000248 process_identifier: 2616 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\HBN.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\HBN.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000024c	1	1
NtGetContextThread Dec. 21, 2022, 10 a.m.	thread_handle: 0x00000248	1	0
NtAllocateVirtualMemory Dec. 21, 2022, 10 a.m.	process_identifier: 2616 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c	1	0
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâoâÏÑâ«ÒãÏÑâ«Ôã<ÏÑâ«Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑâ³ØãgÏÑâ³.âÏÑâ³ÓãÏÑâRichÏÑâPELï5ucàF.)`@ð»ð`J°´9À8T ø@`¸.textÛDF `.rdatat`vJ@@.data,\àÀ@À.tls @Î@À.gfids0PÐ@@.rsrcJ`LÔ@@.reloc´9°: @B base_address: 0x00400000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: base_address: 0x00401000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: base_address: 0x00456000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ \|¥E¨Ez¥E..páFLöFLöFLöFLöFLöFLöFLöFLöFLöFtáFPöFPöFPöFPöFPöFPöFPöFxáFÿÿÿÿ¨EâFâFâFâFâFxáF«E¬EÈºEØáFpçFCPSTPDT âFàâFÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpçFþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨3XF¯4AdFU7ApFt4AfE.?AVtype_info@@fE.?AVbad_alloc@std@@fE.?AVbad_array_new_length@std@@fE.?AVlogic_error@std@@fE.?AVlength_error@std@@fE.?AVout_of_range@std@@fE.?AV_Facet_base@std@@fE.?AV_Locimp@locale@std@@fE.?AVfacet@locale@std@@fE.?AU_Crt_new_delete@std@@fE.?AVcodecvt_base@std@@fE.?AUctype_base@std@@fE.?AV?$ctype@D@std@@fE.?AV?$codecvt@DDU_Mbstatet@@@std@@fE.?AVbad_exception@std@@fE.HfE.?AVfailure@ios_base@std@@fE.?AVruntime_error@std@@fE.?AVsystem_error@std@@fE.?AVbad_cast@std@@fE.?AV_System_error@std@@fE.?AVexception@std@@ base_address: 0x0046e000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: base_address: 0x00474000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: F+>¿Ù>'>ÉÃ>zÆw7w ZÞYÎÎ½Î_//>>dccáNãÝpÙ4¥ï¥ïÀW~Z¦ª~«Aºüêæí3ôöòFd©¤6; b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x00475000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: base_address: 0x00476000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: base_address: 0x0047b000 process_identifier: 2616 process_handle: 0x0000024c	1	1
WriteProcessMemory Dec. 21, 2022, 10 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2616 process_handle: 0x0000024c	1	1
NtSetContextThread Dec. 21, 2022, 10 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4401454 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000248 process_identifier: 2616	1	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.64401658
FireEye	Trojan.GenericKD.64401658
McAfee	Artemis!C32BB2D4BBFF
Malwarebytes	Trojan.MalPack.PNG.Generic
Sangfor	Trojan.Win32.Agent.V6t7
Cyren	W32/MSIL_Kryptik.IOO.gen!Eldorado
Symantec	Scr.Malcode!gdn30
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Kryptik.AHNR
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
BitDefender	Trojan.GenericKD.64401658
DrWeb	Trojan.Siggen19.22481
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	TR/AD.Remcos.uirtd
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
ZoneAlarm	HEUR:Trojan.MSIL.Taskun.gen
GData	Win32.Backdoor.Remcos.M4E76V
Google	Detected
MAX	malware (ai score=84)
TrendMicro-HouseCall	TROJ_GEN.R002H0DLK22
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:rxiKvhSBHfhBxh0p3kDSfw)
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AHNH!tr
Panda	Trj/GdSda.A

HBN.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All