popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

PO_6733.exe

AgentTesla info stealer Generic Malware browser email stealer Google Chrome User Data Antivirus PWS ScreenShot KeyLogger DNS Socket AntiDebug PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 26, 2023, 10:46 a.m. Jan. 26, 2023, 11:09 a.m.
Size 719.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 76218662ffd8397441fadb34d12de1cc
SHA256 7a0c3008b65ed5033cc3663e9104ed7b39707c2a073ef3626549e0acd64f15f2
CRC32 E7261494
ssdeep 12288:Frp6gxML2DQ8iFoFEyK0xlDxjIWD7+j3c1z3tTm9OrncN6lcQBb:FrfxMXSCp0r6WmjM1z39AAn
Yara
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
212.193.30.230 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: , script file, or operable program. Check the spelling of the name, or if a pat
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: h was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:17
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\ogOazdr
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: NW.exe
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: mmandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Updates\ogOazdrNW" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399dc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399f08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399f08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399f08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399708
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399708
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399708
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399708
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399708
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399708
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399f08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399f08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00399f08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a488
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a248
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0039a2c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00680000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00810000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f6c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00811000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f6d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f6e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0237f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02370000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f6f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047a9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x047ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05b30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05b31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05b36000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05b37000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02740000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e721000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0245a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e722000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02452000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02851000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02852000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\ogOazdrNW.exe"
cmdline schtasks.exe /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\test22\AppData\Local\Temp\tmp55E6.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\test22\AppData\Local\Temp\tmp55E6.tmp"
cmdline powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\ogOazdrNW.exe"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\ogOazdrNW.exe"
filepath: powershell
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\test22\AppData\Local\Temp\tmp55E6.tmp"
filepath: schtasks.exe
1 1 0
section {u'size_of_data': u'0x000b2600', u'virtual_address': u'0x00002000', u'entropy': 7.552388527460016, u'name': u'.text', u'virtual_size': u'0x000b24f4'} entropy 7.55238852746 description A section with a high entropy has been found
entropy 0.992350486787 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications over RAW Socket rule Network_TCP_Socket
description Take ScreenShot rule ScreenShot
description Communications use DNS rule Network_DNS
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Run a KeyLogger rule KeyLogger
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description browser info stealer rule infoStealer_browser_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description email clients info stealer rule infoStealer_emailClients_Zero
cmdline schtasks.exe /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\test22\AppData\Local\Temp\tmp55E6.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\test22\AppData\Local\Temp\tmp55E6.tmp"
host 212.193.30.230
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2804
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002cc
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYI ^à  xh-$ @0ŸË ð;è Ð œÔ.text  P`.data\M N@`À.eh_framØp\@0@.bss„f€€`À.edata;ðb@0@.idataèd@0À.relocÐ x@0B
base_address: 0x00400000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: zR| ˆ(Œÿÿ9A†A ƒC q AÃAÆHŒÿÿ,C h`,Œÿÿ,C hxDŒÿÿFC0B|ŒÿÿFC0B¨´Œÿÿ>C0zzR| ˆ ČÿÿaAƒC0| AÃA @ÿÿaAƒC0| AÃA d\ÿÿaAƒC0| AÃA ˆ¨ÿÿICZ E S E JzR| ˆ|¦ÿÿzR| ˆÿÿ+C gzR| ˆ ÿÿKD†A ƒ}ÃEÆ0@¼ÿÿœA‡A †CƒH ‹Aà AÆAÇ,t(Žÿÿ\A†A ƒN ÃAÆA HÃAÆT¤XŽÿÿ…A…A ‡A†CƒE@M AÃAÆ AÇAÅA W EÃAÆ AÇAÅE 8üŽÿÿœA…A ‡C†CƒCPŒAÃAÆ AÇAÅ<8ôŽÿÿyA…A ‡F†AƒC@hAÃAÆ AÇAÅ4x4ÿÿþA‡A †AƒC Ø Aà AÆAÇA °üÿÿ‚AƒC x AÃA 4Ôh‘ÿÿŠA‡A †AƒC0a Aà AÆAÇA 4 À‘ÿÿŠA‡A †AƒC0a Aà AÆAÇA 4D’ÿÿœA‡A †AƒC0p Aà AÆAÇA zR| ˆ<h’ÿÿÑA…A ‡A†AƒC`0 CÃAÆ AÇAÅA zR| ˆ<ð”ÿÿ¸A…C ‡A†AƒC@ˆ AÃAÆ AÇAÅA <\p–ÿÿqA…A ‡A†AƒCpt AÃAÆ AÇAÅA zR| ˆ<Ÿÿÿ`A…A ‡A†AƒC@2 AÃAÆ AÇAÅA zR| ˆ<  ÿÿ?A…B F‡†ƒÚ ÃAÆAÇAÅ A µ ÃAÆAÇAÅ A
base_address: 0x00427000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: YI ^(ð(ð(ð(ð
base_address: 0x0042f000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: X 00 0+010;0E0¦0Ä0Ë0å0*1Ý1ñ1 2%313|34[4S5.68™8¬9´94:Ý:û<==¶=À=Ë=‡>Ç>û>?? Œ¨1õ34¤5P6\6l6|6œ6º6Þ6ç708x8ª8Ñ9$:´;Ã;Ò;ã;÷;„<“<¢<¹<Ë<r=~=’=©=»=í=ø=>(>Ò>Ú>á>è>ú>? ??(?0?7?>?P?[?b?i??‡?Ž?•?§?²?¹?À?Ö?Þ?å?ì?þ?0ô 0001%1;1E1[1b1v1€1˜1Ÿ1³1º1Ë1Ú1ä1ò122+252K2R2d2n2}2„2œ2©2³2Â2Ì2Ú2÷23#353u3‡33¯3í34424m4w4Ž4¤4µ5¼5Ð5Ú5í5ô5 6646;6V6`6p6w66ˆ6±6¸6É6Ó6ê6ñ6777%7?7I7P7[7k7y7¡7¨7Ã7×7ð7ú78,8D8R8n8€88¢8¸8Í8×:ç:;);0;™;º;ä;ø;<‡=¤=Å=Õ=ÿ=„>Ó?ô?@`0)0M0f0—0 11 1{1–11§1®1µ1½1Ä1Õ1Ý1ä1ø12 222&2-282A2H2U2\2i2r2y2†22˜2¡2¨2µ2¼2â2ë2ó2ù23 30373¹3Á3È3Õ3Ý3ä3ñ3ù34 44444A4M4d4q4~4•4¡4®4Ä4Ý4ô4û45!565á5666¾6ç6ï6ù6E7­7Î7Ö7â7ê788+8Q8¦8Â8ý89W9^9e9q9x99†99–99¤9±9Ù9ø9::7:J:P:f:r:w:}:; ;\;d;~;¢;©;²;Æ;><K<R<W<c<j<q<%=4=C=¹=Ù=è=÷=>> >1>@>O>^>m>|>‹>š>©>¸>Ç>Ö>ô>ù>??4?9?Y?f?‡?ª?¯?Px0†0£0µ0Ù0á0í0ô01 111-151=1D1d1–1¡1+8Ë8ˆ9ú9:::‚:¯:º:À:;';@;H;M;Z;É;ì;÷;t<<•<©=Ú=â=ì=ÿ=> >><>C>_>y>È>`, 2•2Ã3Ê3ô355Ç5v6k8¤8Á8Ù8`9¥9c:G;b;­;p0d0«0Ã0ã0 1P1ò1M3¦3&6.7g7„7œ7Ã7ž8ù8(<J<˜>€À§0²1Ç1Ú1ä12h2Ï2î2L3£3*464U4a4’4é4M5Š566*616?6¨6®6ï6õ6 777*7q7®72888N8U8f8Ò8Ø89959<9¦9Â9á9:M:i:Ú:Y;f;;š;¿;×;ß;"<@<\<q<™<´<Ì<ä<ü<=,=D=\=t=Œ=¤=¼=ñ=ü=>4>9>C>m>>À>Æ>Ñ>?›?¡?Á?Ô?¸0'0[0c0x0ž0¦0Ë0û01'1/112É2â23$3D3[3˜3¥3Ë3ç3û34#4+4W4_4À4a5Š5!6Ì6ç6E7ó7€8¨8Ã8Ë8Ú8ß8ö8 99.999C9M9[9a9u9™9÷9ÿ9<:µ:ç:ò:;…;l<™<Í<ò<==!=*=3=<=E=N=W=`=i=r={=„=c>m>å>C?~?î?û? \ 0<0{0Ê011!1;1C1S1_1y1®1Î1ƒ2Ï2×2y3ê3@4H4˜4 45£5»5ò5ú5 6?6†6ª6ä6ë677@7¥7Ä7Þ7þ7{8°tç2-3P3Ö34?4ß45K5s5&6>6^6}6å6ú6777L7Þ788³8Æ89909S9f9¯9»9Ð9ó9:O:[:…:·:ê:;0;[;†;±;Ü;<2<[<‚<«<Ö<-=B=Ð?Àpr0<1s1à12~3L4X4Š4–4½4055“5Á56>6Œ6´6Å68y8¸8ì89\9Œ9¿9ü9,:_:œ:Ì:ÿ:<;p;£;#<5=’=Ñ=>8>u>¥>Ø>?E?x?µ?å?ÐH0U0‰0¼0<1v2k3·3 4Y4v5­5;6i6–6747'8ò9•:5=Ý=(>@>q>°>Ü>&?O?‹?¯?ã?à,0 0:0Z0t0’0o3§5q6y6†6*9³:Ç:Û:>â>ðd)1”1´1Ã2×2ë2¾4Ê4(5<5W5d5¿5Ë5)6=6X6e6À6Ì6*7>7Y7f7Á7Í7+8?8Z8g8Æ8Ó8"969Q9^9½9Ê9:-:H:U:°:¼:D;D»1Ç1ç1ó1k2Ð2934‘44¢4§4¬4±4¸4É4æ4ó45551565M57;=@>¾>M?Ì?00Ø012‘3à3u46d6x6Ÿ6«6q7È8;9E9Z9ô9“?  40Tj3þ3 4ø4Ì5Ø5}7Ø7ä7[8p8“8½8×8å8ÿ8 9|:À:;;O;“;›;Ä;<”<¸<Ù<ï<=Q=Ô=ì=k>º>i?@ 0®1#2|2É2*34É4ó4¼699˜9P8u7È7U8\8¥8¬8î8w::¤:Ï:Ö:;";{;‚;’;™;<|<ƒ<¾=Å=`/060.3;3H3å3ì3p ¢4³4Ä4{5ˆ5T6]6h7±>/?:?`?€002Þ2.9>9n;u;Æ:Í:ù:;/;³;º; 8 00ö2ý2e3k3x3"444O4:5M5Z5¦5­5 8§8œ;<e<E=R=Š?’?° ø0­1À$?6c6 8P8­8™9¦9³9–:¢:Õ:P>W>Ð0k4G5N5Q7â;é;àž1š2ð2!4@49:@:;e<c>ðˆZ0¨3¶6¾6Æ6Î6Ö6Þ6æ6î6ö6þ67777&7.767>7F7N7V7^7f7n7v7~7†7Ž7–7ž7¦7®7¶7¾7Æ7Î7Ö7Þ7æ7î7ö7þ78888&8.868>8F8N8V8^8f8n8v8~8†8Ž8–8ž8¦8®8¶8¾8Æ8Î8Ö8Þ8æ8î8ö8þ89999&9.969>9F9N9V9^9f9n9v9~9†9Ž9–9ž9¦9®9¶9¾9Æ9Î9Ö9Þ9æ9î9ö9þ9::::&:.:6:>:F:N:V:^:f:n:v:~:†:Ž:–:ž:¦:®:¶:¾:Æ:Î:Ö:Þ:æ:î:ö:þ:;;;;&;.;6;>;F;N;V;^;f;n;v;~;†;Ž;–;ž;¦;®;¶;¾;Æ;Î;Ö;Þ;æ;î;ö;þ;<<J<Ï<=o=¹=î=õ=û=)>^>e>k>™>Î>Õ>Û>?Hº4Á4Ç4ß4æ4ì475w5~5„5Ú5666¦6­6³6ì7ó7ù7{9‚9ˆ9å:ì:ò:B;I;O;%?,?2?4¦1­1³1Ï4ë4õ455`5n5{5‚5ª5±5·5Á7È7Î7æ7í7ó7 4`9d9h9l9p9t9x9|9€9„9ˆ9Œ99”9˜9œ9 9¤9¨9¬9°9´9¸9¼9À9Ä9È9Ì9Ð9Ô9Ø9Ü9à9ä9è9ì9ð9ô9ø9ü9::: : :$:(:,:0:4:8:<:@:¼:À:Ä:È:Ì:Ð:Ô:Ø:Ü:à:ä:è:ì:ð:ô:ø:ü:;;; ;;;;; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;€;„;ˆ;Œ;;”;˜;œ; ;¤;¨;¬;°;´;¸;¼;À;Ä;È;Ì;Ð;Ô;Ø;Ü;à;ä;è;ì;ð;ô;ø;ü;<<@=D=H=L=P=T=X=\=`=d=h=l=p=0 h>l>p>t>x>|>€>„>ˆ>Œ>>@¬è4ì4ð4ô4ø4ü4555 555P5T5X5\5`5d5H8L8P8T8X8\8`8d8h8l8p8t8x8|8€8„8ˆ8Œ88”8˜8œ8 8¤8¨8¬8°8´8¸8¼8À8Ä8È8Ì8Ð8Ô8Ø8Ü8à8ä8è8ì8ð8ô8ø8ü8999 99999$>,>4><>D>L>T>\>d>l>
base_address: 0x00432000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2804
process_handle: 0x000002cc
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYI ^à  xh-$ @0ŸË ð;è Ð œÔ.text  P`.data\M N@`À.eh_framØp\@0@.bss„f€€`À.edata;ðb@0@.idataèd@0À.relocÐ x@0B
base_address: 0x00400000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0
Process injection Process 1880 called NtSetContextThread to modify thread in remote process 2804
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4203565
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000388
process_identifier: 2804
1 0 0
Process injection Process 1880 resumed a thread in remote process 2804
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000388
suspend_count: 1
process_identifier: 2804
1 0 0
dead_host 212.193.30.230:3363
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1880
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1880
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1880
1 0 0

CreateProcessInternalW

 thread_identifier: 2660
thread_handle: 0x000003d4
process_identifier: 2656
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\ogOazdrNW.exe"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003dc
1 1 0

CreateProcessInternalW

 thread_identifier: 2712
thread_handle: 0x00000394
process_identifier: 2708
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\test22\AppData\Local\Temp\tmp55E6.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003dc
1 1 0

CreateProcessInternalW

 thread_identifier: 2808
thread_handle: 0x00000388
process_identifier: 2804
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\PO_6733.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\PO_6733.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002cc
1 1 0

NtGetContextThread

 thread_handle: 0x00000388
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2804
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002cc
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYI ^à  xh-$ @0ŸË ð;è Ð œÔ.text  P`.data\M N@`À.eh_framØp\@0@.bss„f€€`À.edata;ðb@0@.idataèd@0À.relocÐ x@0B
base_address: 0x00400000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00422000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: zR| ˆ(Œÿÿ9A†A ƒC q AÃAÆHŒÿÿ,C h`,Œÿÿ,C hxDŒÿÿFC0B|ŒÿÿFC0B¨´Œÿÿ>C0zzR| ˆ ČÿÿaAƒC0| AÃA @ÿÿaAƒC0| AÃA d\ÿÿaAƒC0| AÃA ˆ¨ÿÿICZ E S E JzR| ˆ|¦ÿÿzR| ˆÿÿ+C gzR| ˆ ÿÿKD†A ƒ}ÃEÆ0@¼ÿÿœA‡A †CƒH ‹Aà AÆAÇ,t(Žÿÿ\A†A ƒN ÃAÆA HÃAÆT¤XŽÿÿ…A…A ‡A†CƒE@M AÃAÆ AÇAÅA W EÃAÆ AÇAÅE 8üŽÿÿœA…A ‡C†CƒCPŒAÃAÆ AÇAÅ<8ôŽÿÿyA…A ‡F†AƒC@hAÃAÆ AÇAÅ4x4ÿÿþA‡A †AƒC Ø Aà AÆAÇA °üÿÿ‚AƒC x AÃA 4Ôh‘ÿÿŠA‡A †AƒC0a Aà AÆAÇA 4 À‘ÿÿŠA‡A †AƒC0a Aà AÆAÇA 4D’ÿÿœA‡A †AƒC0p Aà AÆAÇA zR| ˆ<h’ÿÿÑA…A ‡A†AƒC`0 CÃAÆ AÇAÅA zR| ˆ<ð”ÿÿ¸A…C ‡A†AƒC@ˆ AÃAÆ AÇAÅA <\p–ÿÿqA…A ‡A†AƒCpt AÃAÆ AÇAÅA zR| ˆ<Ÿÿÿ`A…A ‡A†AƒC@2 AÃAÆ AÇAÅA zR| ˆ<  ÿÿ?A…B F‡†ƒÚ ÃAÆAÇAÅ A µ ÃAÆAÇAÅ A
base_address: 0x00427000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: YI ^(ð(ð(ð(ð
base_address: 0x0042f000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00430000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: X 00 0+010;0E0¦0Ä0Ë0å0*1Ý1ñ1 2%313|34[4S5.68™8¬9´94:Ý:û<==¶=À=Ë=‡>Ç>û>?? Œ¨1õ34¤5P6\6l6|6œ6º6Þ6ç708x8ª8Ñ9$:´;Ã;Ò;ã;÷;„<“<¢<¹<Ë<r=~=’=©=»=í=ø=>(>Ò>Ú>á>è>ú>? ??(?0?7?>?P?[?b?i??‡?Ž?•?§?²?¹?À?Ö?Þ?å?ì?þ?0ô 0001%1;1E1[1b1v1€1˜1Ÿ1³1º1Ë1Ú1ä1ò122+252K2R2d2n2}2„2œ2©2³2Â2Ì2Ú2÷23#353u3‡33¯3í34424m4w4Ž4¤4µ5¼5Ð5Ú5í5ô5 6646;6V6`6p6w66ˆ6±6¸6É6Ó6ê6ñ6777%7?7I7P7[7k7y7¡7¨7Ã7×7ð7ú78,8D8R8n8€88¢8¸8Í8×:ç:;);0;™;º;ä;ø;<‡=¤=Å=Õ=ÿ=„>Ó?ô?@`0)0M0f0—0 11 1{1–11§1®1µ1½1Ä1Õ1Ý1ä1ø12 222&2-282A2H2U2\2i2r2y2†22˜2¡2¨2µ2¼2â2ë2ó2ù23 30373¹3Á3È3Õ3Ý3ä3ñ3ù34 44444A4M4d4q4~4•4¡4®4Ä4Ý4ô4û45!565á5666¾6ç6ï6ù6E7­7Î7Ö7â7ê788+8Q8¦8Â8ý89W9^9e9q9x99†99–99¤9±9Ù9ø9::7:J:P:f:r:w:}:; ;\;d;~;¢;©;²;Æ;><K<R<W<c<j<q<%=4=C=¹=Ù=è=÷=>> >1>@>O>^>m>|>‹>š>©>¸>Ç>Ö>ô>ù>??4?9?Y?f?‡?ª?¯?Px0†0£0µ0Ù0á0í0ô01 111-151=1D1d1–1¡1+8Ë8ˆ9ú9:::‚:¯:º:À:;';@;H;M;Z;É;ì;÷;t<<•<©=Ú=â=ì=ÿ=> >><>C>_>y>È>`, 2•2Ã3Ê3ô355Ç5v6k8¤8Á8Ù8`9¥9c:G;b;­;p0d0«0Ã0ã0 1P1ò1M3¦3&6.7g7„7œ7Ã7ž8ù8(<J<˜>€À§0²1Ç1Ú1ä12h2Ï2î2L3£3*464U4a4’4é4M5Š566*616?6¨6®6ï6õ6 777*7q7®72888N8U8f8Ò8Ø89959<9¦9Â9á9:M:i:Ú:Y;f;;š;¿;×;ß;"<@<\<q<™<´<Ì<ä<ü<=,=D=\=t=Œ=¤=¼=ñ=ü=>4>9>C>m>>À>Æ>Ñ>?›?¡?Á?Ô?¸0'0[0c0x0ž0¦0Ë0û01'1/112É2â23$3D3[3˜3¥3Ë3ç3û34#4+4W4_4À4a5Š5!6Ì6ç6E7ó7€8¨8Ã8Ë8Ú8ß8ö8 99.999C9M9[9a9u9™9÷9ÿ9<:µ:ç:ò:;…;l<™<Í<ò<==!=*=3=<=E=N=W=`=i=r={=„=c>m>å>C?~?î?û? \ 0<0{0Ê011!1;1C1S1_1y1®1Î1ƒ2Ï2×2y3ê3@4H4˜4 45£5»5ò5ú5 6?6†6ª6ä6ë677@7¥7Ä7Þ7þ7{8°tç2-3P3Ö34?4ß45K5s5&6>6^6}6å6ú6777L7Þ788³8Æ89909S9f9¯9»9Ð9ó9:O:[:…:·:ê:;0;[;†;±;Ü;<2<[<‚<«<Ö<-=B=Ð?Àpr0<1s1à12~3L4X4Š4–4½4055“5Á56>6Œ6´6Å68y8¸8ì89\9Œ9¿9ü9,:_:œ:Ì:ÿ:<;p;£;#<5=’=Ñ=>8>u>¥>Ø>?E?x?µ?å?ÐH0U0‰0¼0<1v2k3·3 4Y4v5­5;6i6–6747'8ò9•:5=Ý=(>@>q>°>Ü>&?O?‹?¯?ã?à,0 0:0Z0t0’0o3§5q6y6†6*9³:Ç:Û:>â>ðd)1”1´1Ã2×2ë2¾4Ê4(5<5W5d5¿5Ë5)6=6X6e6À6Ì6*7>7Y7f7Á7Í7+8?8Z8g8Æ8Ó8"969Q9^9½9Ê9:-:H:U:°:¼:D;D»1Ç1ç1ó1k2Ð2934‘44¢4§4¬4±4¸4É4æ4ó45551565M57;=@>¾>M?Ì?00Ø012‘3à3u46d6x6Ÿ6«6q7È8;9E9Z9ô9“?  40Tj3þ3 4ø4Ì5Ø5}7Ø7ä7[8p8“8½8×8å8ÿ8 9|:À:;;O;“;›;Ä;<”<¸<Ù<ï<=Q=Ô=ì=k>º>i?@ 0®1#2|2É2*34É4ó4¼699˜9P8u7È7U8\8¥8¬8î8w::¤:Ï:Ö:;";{;‚;’;™;<|<ƒ<¾=Å=`/060.3;3H3å3ì3p ¢4³4Ä4{5ˆ5T6]6h7±>/?:?`?€002Þ2.9>9n;u;Æ:Í:ù:;/;³;º; 8 00ö2ý2e3k3x3"444O4:5M5Z5¦5­5 8§8œ;<e<E=R=Š?’?° ø0­1À$?6c6 8P8­8™9¦9³9–:¢:Õ:P>W>Ð0k4G5N5Q7â;é;àž1š2ð2!4@49:@:;e<c>ðˆZ0¨3¶6¾6Æ6Î6Ö6Þ6æ6î6ö6þ67777&7.767>7F7N7V7^7f7n7v7~7†7Ž7–7ž7¦7®7¶7¾7Æ7Î7Ö7Þ7æ7î7ö7þ78888&8.868>8F8N8V8^8f8n8v8~8†8Ž8–8ž8¦8®8¶8¾8Æ8Î8Ö8Þ8æ8î8ö8þ89999&9.969>9F9N9V9^9f9n9v9~9†9Ž9–9ž9¦9®9¶9¾9Æ9Î9Ö9Þ9æ9î9ö9þ9::::&:.:6:>:F:N:V:^:f:n:v:~:†:Ž:–:ž:¦:®:¶:¾:Æ:Î:Ö:Þ:æ:î:ö:þ:;;;;&;.;6;>;F;N;V;^;f;n;v;~;†;Ž;–;ž;¦;®;¶;¾;Æ;Î;Ö;Þ;æ;î;ö;þ;<<J<Ï<=o=¹=î=õ=û=)>^>e>k>™>Î>Õ>Û>?Hº4Á4Ç4ß4æ4ì475w5~5„5Ú5666¦6­6³6ì7ó7ù7{9‚9ˆ9å:ì:ò:B;I;O;%?,?2?4¦1­1³1Ï4ë4õ455`5n5{5‚5ª5±5·5Á7È7Î7æ7í7ó7 4`9d9h9l9p9t9x9|9€9„9ˆ9Œ99”9˜9œ9 9¤9¨9¬9°9´9¸9¼9À9Ä9È9Ì9Ð9Ô9Ø9Ü9à9ä9è9ì9ð9ô9ø9ü9::: : :$:(:,:0:4:8:<:@:¼:À:Ä:È:Ì:Ð:Ô:Ø:Ü:à:ä:è:ì:ð:ô:ø:ü:;;; ;;;;; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;€;„;ˆ;Œ;;”;˜;œ; ;¤;¨;¬;°;´;¸;¼;À;Ä;È;Ì;Ð;Ô;Ø;Ü;à;ä;è;ì;ð;ô;ø;ü;<<@=D=H=L=P=T=X=\=`=d=h=l=p=0 h>l>p>t>x>|>€>„>ˆ>Œ>>@¬è4ì4ð4ô4ø4ü4555 555P5T5X5\5`5d5H8L8P8T8X8\8`8d8h8l8p8t8x8|8€8„8ˆ8Œ88”8˜8œ8 8¤8¨8¬8°8´8¸8¼8À8Ä8È8Ì8Ð8Ô8Ø8Ü8à8ä8è8ì8ð8ô8ø8ü8999 99999$>,>4><>D>L>T>\>d>l>
base_address: 0x00432000
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2804
process_handle: 0x000002cc
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4203565
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000388
process_identifier: 2804
1 0 0

NtResumeThread

 thread_handle: 0x00000388
suspend_count: 1
process_identifier: 2804
1 0 0

NtResumeThread

 thread_handle: 0x000002ac
suspend_count: 1
process_identifier: 2656
1 0 0

NtResumeThread

 thread_handle: 0x00000300
suspend_count: 1
process_identifier: 2656
1 0 0

NtResumeThread

 thread_handle: 0x0000044c
suspend_count: 1
process_identifier: 2656
1 0 0

NtResumeThread

 thread_handle: 0x000004ac
suspend_count: 1
process_identifier: 2656
1 0 0
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.NetWiredRC.4!c
Elastic malicious (high confidence)
McAfee Artemis!76218662FFD8
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
Alibaba Trojan:Win32/starter.ali1000139
Cyren W32/MSIL_Kryptik.ITZ.gen!Eldorado
Symantec Scr.Malcode!gdn34
ESET-NOD32 a variant of MSIL/Kryptik.AHWD
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:PWSX-gen [Trj]
F-Secure Trojan.TR/AD.Abamousse.bkdwq
DrWeb Trojan.PackedNET.1797
TrendMicro Backdoor.Win32.NETWIRE.YXDAYZ
McAfee-GW-Edition BehavesLike.Win32.Generic.bc
FireEye Generic.mg.76218662ffd83974
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Avira TR/AD.Abamousse.bkdwq
Microsoft Trojan:MSIL/NanoBot.D!MTB
GData Win32.Backdoor.NetWireRC.JJCJPJ
Google Detected
VBA32 CIL.HeapOverride.Heur
Malwarebytes Trojan.MalPack.PNG.Generic
TrendMicro-HouseCall Backdoor.Win32.NETWIRE.YXDAYZ
Rising Malware.Obfus/MSIL@AI.91 (RDM.MSIL2:ZypCSnf+hS36kLnPdeMViQ)
MaxSecure Trojan.Malware.300983.susgen
BitDefenderTheta Gen:NN.ZemsilF.36212.Sm0@ayBD3Xf
AVG Win32:PWSX-gen [Trj]