popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

EKL.exe

AgentTesla info stealer browser Google Downloader Chrome User Data Socket Escalate priviledges Create Service KeyLogger Internet API Sniff Audio DNS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 7, 2023, 4:43 p.m. March 7, 2023, 4:45 p.m.
Size 1.3MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 21eee575b2425a16123e5eccb8d280c6
SHA256 af9f2d56bf530f612c18e4a21f654aa8b5be48ad80a92c770699791907d95b55
CRC32 946C18FF
ssdeep 12288:EMunAGk2GV5ItArRiuKV2jzbhrnM7amMLSUKkmiUKNe3Ra/YiHhAqkvWdFlLgC0F:ckdV5uAZb2A5KgyMQ9B+dbsC0a75
Yara
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
craigjonson1.gotdns.ch
A 194.180.49.19
194.180.49.19
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
194.180.49.19 Active Moloch
23.111.184.154 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2042740 ET INFO DYNAMIC_DNS Query to a *.gotdns .ch Domain Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 194.180.49.19:2011 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49171
194.180.49.19:2011 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00810000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1460
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1460
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b70000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00532000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00565000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00567000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00556000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d7f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ae000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007af000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1460
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2892
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2892
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72ee2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00452000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00495000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00497000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description trs.exe tried to sleep 122 seconds, actually delayed analysis time by 122 seconds
file C:\Users\test22\AppData\Local\Temp\cyzzesdwukqsunu.vbs
cmdline "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\trs.exe"
file C:\Users\test22\AppData\Local\Temp\cyzzesdwukqsunu.vbs
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\cyzzesdwukqsunu.vbs
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\cyzzesdwukqsunu.vbs
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c "C:\Users\test22\AppData\Roaming\trs.exe"
filepath: cmd
1 1 0
section {u'size_of_data': u'0x00140600', u'virtual_address': u'0x00002000', u'entropy': 7.697941768442103, u'name': u'.text', u'virtual_size': u'0x0014040c'} entropy 7.69794176844 description A section with a high entropy has been found
entropy 0.99844176081 description Overall entropy of this PE file is high
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Run a KeyLogger rule KeyLogger
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description browser info stealer rule infoStealer_browser_Zero
description File Downloader rule Network_Downloader
description Escalate priviledges rule Escalate_priviledges
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Run a KeyLogger rule KeyLogger
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description browser info stealer rule infoStealer_browser_Zero
description File Downloader rule Network_Downloader
description Escalate priviledges rule Escalate_priviledges
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
host 23.111.184.154
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 520192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b8
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1492
region_size: 520192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b8
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ee reg_value "C:\Users\test22\AppData\Roaming\trs.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ee reg_value "C:\Users\test22\AppData\Roaming\trs.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ee reg_value "C:\Users\test22\AppData\Roaming\trs.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ee reg_value "C:\Users\test22\AppData\Roaming\trs.exe"
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâ˜oâÏÑ⫑ÒãÏÑ⫑Ôã<ÏÑ⫑Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑⳑØãgÏÑⳑ.âÏÑⳑÓãÏÑâRichÏÑâPEL½*¢cà H&,`@ð€h»ð`ÜJ°È9  8´ X @`¸.text»GH `.rdataüt`vL@@.data4\àÂ@À.tls @Ð@À.gfids0PÒ@@.rsrcÜJ`LÖ@@.relocÈ9°:"@B
base_address: 0x00400000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    |¥E€¨Ez¥E..páFLöFLöFLöFLöFLöFLöFLöFLöFLöFtáFPöFPöFPöFPöFPöFPöFPöFxáFÿÿÿÿ€¨E˜âF˜âF˜âF˜âF˜âFxáF«E€¬EȺEØáFpçFCPSTPDT âFàâFÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpçFþÿÿÿþÿÿÿu˜0Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¸“F•8AēF;;AГFZ8A„fE.?AVtype_info@@„fE.?AVbad_alloc@std@@„fE.?AVbad_array_new_length@std@@„fE.?AVlogic_error@std@@„fE.?AVlength_error@std@@„fE.?AVout_of_range@std@@„fE.?AV_Facet_base@std@@„fE.?AV_Locimp@locale@std@@„fE.?AVfacet@locale@std@@„fE.?AU_Crt_new_delete@std@@„fE.?AVcodecvt_base@std@@„fE.?AUctype_base@std@@„fE.?AV?$ctype@D@std@@„fE.?AV?$codecvt@DDU_Mbstatet@@@std@@„fE.?AVbad_exception@std@@„fE.H„fE.?AVfailure@ios_base@std@@„fE.?AVruntime_error@std@@„fE.?AVsystem_error@std@@„fE.?AVbad_cast@std@@„fE.?AV_System_error@std@@„fE.?AVexception@std@@
base_address: 0x0046e000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x00474000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: öÛ‡>Pj‡>¸‡>)Ƈ>[Éíy—yj\>\¯¯ÑžÑ@2è1‡>‡>pfÃer>/ævàQÜ÷6lõlõ ZÞ\V­.®¡¼âÝíÇð÷dùøô¦f §åt9c> b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x00475000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâ˜oâÏÑ⫑ÒãÏÑ⫑Ôã<ÏÑ⫑Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑⳑØãgÏÑⳑ.âÏÑⳑÓãÏÑâRichÏÑâPEL½*¢cà H&,`@ð€h»ð`ÜJ°È9  8´ X @`¸.text»GH `.rdataüt`vL@@.data4\àÂ@À.tls @Ð@À.gfids0PÒ@@.rsrcÜJ`LÖ@@.relocÈ9°:"@B
base_address: 0x00400000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    |¥E€¨Ez¥E..páFLöFLöFLöFLöFLöFLöFLöFLöFLöFtáFPöFPöFPöFPöFPöFPöFPöFxáFÿÿÿÿ€¨E˜âF˜âF˜âF˜âF˜âFxáF«E€¬EȺEØáFpçFCPSTPDT âFàâFÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpçFþÿÿÿþÿÿÿu˜0Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¸“F•8AēF;;AГFZ8A„fE.?AVtype_info@@„fE.?AVbad_alloc@std@@„fE.?AVbad_array_new_length@std@@„fE.?AVlogic_error@std@@„fE.?AVlength_error@std@@„fE.?AVout_of_range@std@@„fE.?AV_Facet_base@std@@„fE.?AV_Locimp@locale@std@@„fE.?AVfacet@locale@std@@„fE.?AU_Crt_new_delete@std@@„fE.?AVcodecvt_base@std@@„fE.?AUctype_base@std@@„fE.?AV?$ctype@D@std@@„fE.?AV?$codecvt@DDU_Mbstatet@@@std@@„fE.?AVbad_exception@std@@„fE.H„fE.?AVfailure@ios_base@std@@„fE.?AVruntime_error@std@@„fE.?AVsystem_error@std@@„fE.?AVbad_cast@std@@„fE.?AV_System_error@std@@„fE.?AVexception@std@@
base_address: 0x0046e000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x00474000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: öÛ‡>Pj‡>¸‡>)Ƈ>[Éíy—yj\>\¯¯ÑžÑ@2è1‡>‡>pfÃer>/ævàQÜ÷6lõlõ ZÞ\V­.®¡¼âÝíÇð÷dùøô¦f §åt9c> b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x00475000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1492
process_handle: 0x000002b8
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâ˜oâÏÑ⫑ÒãÏÑ⫑Ôã<ÏÑ⫑Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑⳑØãgÏÑⳑ.âÏÑⳑÓãÏÑâRichÏÑâPEL½*¢cà H&,`@ð€h»ð`ÜJ°È9  8´ X @`¸.text»GH `.rdataüt`vL@@.data4\àÂ@À.tls @Ð@À.gfids0PÒ@@.rsrcÜJ`LÖ@@.relocÈ9°:"@B
base_address: 0x00400000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâ˜oâÏÑ⫑ÒãÏÑ⫑Ôã<ÏÑ⫑Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑⳑØãgÏÑⳑ.âÏÑⳑÓãÏÑâRichÏÑâPEL½*¢cà H&,`@ð€h»ð`ÜJ°È9  8´ X @`¸.text»GH `.rdataüt`vL@@.data4\àÂ@À.tls @Ð@À.gfids0PÒ@@.rsrcÜJ`LÖ@@.relocÈ9°:"@B
base_address: 0x00400000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040949d
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 1376691 0
Process injection Process 1460 called NtSetContextThread to modify thread in remote process 2664
Process injection Process 2892 called NtSetContextThread to modify thread in remote process 1492
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4402214
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002c0
process_identifier: 2664
1 0 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4402214
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002c0
process_identifier: 1492
1 0 0
parent_process wscript.exe martian_process cmd /c "C:\Users\test22\AppData\Roaming\trs.exe"
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\trs.exe"
Process injection Process 1460 resumed a thread in remote process 2664
Process injection Process 2892 resumed a thread in remote process 1492
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c0
suspend_count: 1
process_identifier: 2664
1 0 0

NtResumeThread

 thread_handle: 0x000002c0
suspend_count: 1
process_identifier: 1492
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1460
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1460
1 0 0

NtResumeThread

 thread_handle: 0x00000194
suspend_count: 1
process_identifier: 1460
1 0 0

NtResumeThread

 thread_handle: 0x00000244
suspend_count: 1
process_identifier: 1460
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 1460
1 0 0

CreateProcessInternalW

 thread_identifier: 2668
thread_handle: 0x000002c0
process_identifier: 2664
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\EKL.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\EKL.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002b8
1 1 0

NtGetContextThread

 thread_handle: 0x000002c0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 520192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b8
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâ˜oâÏÑ⫑ÒãÏÑ⫑Ôã<ÏÑ⫑Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑⳑØãgÏÑⳑ.âÏÑⳑÓãÏÑâRichÏÑâPEL½*¢cà H&,`@ð€h»ð`ÜJ°È9  8´ X @`¸.text»GH `.rdataüt`vL@@.data4\àÂ@À.tls @Ð@À.gfids0PÒ@@.rsrcÜJ`LÖ@@.relocÈ9°:"@B
base_address: 0x00400000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00456000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    |¥E€¨Ez¥E..páFLöFLöFLöFLöFLöFLöFLöFLöFLöFtáFPöFPöFPöFPöFPöFPöFPöFxáFÿÿÿÿ€¨E˜âF˜âF˜âF˜âF˜âFxáF«E€¬EȺEØáFpçFCPSTPDT âFàâFÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpçFþÿÿÿþÿÿÿu˜0Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¸“F•8AēF;;AГFZ8A„fE.?AVtype_info@@„fE.?AVbad_alloc@std@@„fE.?AVbad_array_new_length@std@@„fE.?AVlogic_error@std@@„fE.?AVlength_error@std@@„fE.?AVout_of_range@std@@„fE.?AV_Facet_base@std@@„fE.?AV_Locimp@locale@std@@„fE.?AVfacet@locale@std@@„fE.?AU_Crt_new_delete@std@@„fE.?AVcodecvt_base@std@@„fE.?AUctype_base@std@@„fE.?AV?$ctype@D@std@@„fE.?AV?$codecvt@DDU_Mbstatet@@@std@@„fE.?AVbad_exception@std@@„fE.H„fE.?AVfailure@ios_base@std@@„fE.?AVruntime_error@std@@„fE.?AVsystem_error@std@@„fE.?AVbad_cast@std@@„fE.?AV_System_error@std@@„fE.?AVexception@std@@
base_address: 0x0046e000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x00474000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: öÛ‡>Pj‡>¸‡>)Ƈ>[Éíy—yj\>\¯¯ÑžÑ@2è1‡>‡>pfÃer>/ævàQÜ÷6lõlõ ZÞ\V­.®¡¼âÝíÇð÷dùøô¦f §åt9c> b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x00475000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00476000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0047b000
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2664
process_handle: 0x000002b8
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4402214
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002c0
process_identifier: 2664
1 0 0

NtResumeThread

 thread_handle: 0x000002c0
suspend_count: 1
process_identifier: 2664
1 0 0

NtResumeThread

 thread_handle: 0x00000274
suspend_count: 1
process_identifier: 2664
1 0 0

CreateProcessInternalW

 thread_identifier: 2764
thread_handle: 0x00000298
process_identifier: 2760
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\wscript.exe
track: 1
command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\cyzzesdwukqsunu.vbs"
filepath_r: C:\Windows\System32\WScript.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000028c
1 1 0

CreateProcessInternalW

 thread_identifier: 2836
thread_handle: 0x000002f8
process_identifier: 2832
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\trs.exe"
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000300
1 1 0

CreateProcessInternalW

 thread_identifier: 2896
thread_handle: 0x00000084
process_identifier: 2892
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Roaming\trs.exe
track: 1
command_line: C:\Users\test22\AppData\Roaming\trs.exe
filepath_r: C:\Users\test22\AppData\Roaming\trs.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2892
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2892
1 0 0

NtResumeThread

 thread_handle: 0x00000194
suspend_count: 1
process_identifier: 2892
1 0 0

NtResumeThread

 thread_handle: 0x00000244
suspend_count: 1
process_identifier: 2892
1 0 0

CreateProcessInternalW

 thread_identifier: 1532
thread_handle: 0x000002c0
process_identifier: 1492
current_directory:
filepath: C:\Users\test22\AppData\Roaming\trs.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Roaming\trs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002b8
1 1 0

NtGetContextThread

 thread_handle: 0x000002c0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1492
region_size: 520192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b8
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $B®¿±ÏÑâÏÑâÏÑâ²S âÏÑâ²S"â¡ÏÑâ²S#âÏÑâ·UâÏÑâ˜oâÏÑ⫑ÒãÏÑ⫑Ôã<ÏÑ⫑Õã$ÏÑâ·BâÏÑâÏÐâ)ÎÑⳑØãgÏÑⳑ.âÏÑⳑÓãÏÑâRichÏÑâPEL½*¢cà H&,`@ð€h»ð`ÜJ°È9  8´ X @`¸.text»GH `.rdataüt`vL@@.data4\àÂ@À.tls @Ð@À.gfids0PÒ@@.rsrcÜJ`LÖ@@.relocÈ9°:"@B
base_address: 0x00400000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00456000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    |¥E€¨Ez¥E..páFLöFLöFLöFLöFLöFLöFLöFLöFLöFtáFPöFPöFPöFPöFPöFPöFPöFxáFÿÿÿÿ€¨E˜âF˜âF˜âF˜âF˜âFxáF«E€¬EȺEØáFpçFCPSTPDT âFàâFÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZpçFþÿÿÿþÿÿÿu˜0Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¸“F•8AēF;;AГFZ8A„fE.?AVtype_info@@„fE.?AVbad_alloc@std@@„fE.?AVbad_array_new_length@std@@„fE.?AVlogic_error@std@@„fE.?AVlength_error@std@@„fE.?AVout_of_range@std@@„fE.?AV_Facet_base@std@@„fE.?AV_Locimp@locale@std@@„fE.?AVfacet@locale@std@@„fE.?AU_Crt_new_delete@std@@„fE.?AVcodecvt_base@std@@„fE.?AUctype_base@std@@„fE.?AV?$ctype@D@std@@„fE.?AV?$codecvt@DDU_Mbstatet@@@std@@„fE.?AVbad_exception@std@@„fE.H„fE.?AVfailure@ios_base@std@@„fE.?AVruntime_error@std@@„fE.?AVsystem_error@std@@„fE.?AVbad_cast@std@@„fE.?AV_System_error@std@@„fE.?AVexception@std@@
base_address: 0x0046e000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x00474000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: öÛ‡>Pj‡>¸‡>)Ƈ>[Éíy—yj\>\¯¯ÑžÑ@2è1‡>‡>pfÃer>/ævàQÜ÷6lõlõ ZÞ\V­.®¡¼âÝíÇð÷dùøô¦f §åt9c> b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x00475000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00476000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0047b000
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1492
process_handle: 0x000002b8
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4402214
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002c0
process_identifier: 1492
1 0 0

NtResumeThread

 thread_handle: 0x000002c0
suspend_count: 1
process_identifier: 1492
1 0 0
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.SnakeLogger.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.65749005
FireEye Generic.mg.21eee575b2425a16
CAT-QuickHeal TrojanSpy.MSIL
McAfee AgentTesla-FDAV!21EEE575B242
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0059f9d61 )
Alibaba TrojanSpy:MSIL/SnakeLogger.3417fe4a
K7GW Trojan ( 0059f9d61 )
Cybereason malicious.7edac5
Arcabit Trojan.Generic.D3EB400D
Cyren W32/MSIL_Kryptik.IZO.gen!Eldorado
Symantec MSIL.Packed.31
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/Kryptik.AIFT
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.MSIL.SnakeLogger.gen
BitDefender Trojan.GenericKD.65749005
Avast Win32:PWSX-gen [Trj]
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:jRKksVPHNfEFfvbWbDm6Ng)
Emsisoft Trojan.GenericKD.65749005 (B)
DrWeb Trojan.PWS.Siggen3.27084
VIPRE Trojan.GenericKD.65749005
TrendMicro TROJ_GEN.R011C0DC423
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Trapmine suspicious.low.ml.score
Sophos Troj/Krypt-VL
Ikarus Trojan.MSIL.Inject
Avira TR/AD.Remcos.szlbr
Antiy-AVL Trojan/MSIL.Kryptik
Microsoft Trojan:MSIL/AgentTesla.EAA!MTB
GData Trojan.GenericKD.65749005
Google Detected
AhnLab-V3 Trojan/Win.AgentTesla.C5390313
ALYac Trojan.GenericKD.65749005
MAX malware (ai score=89)
Malwarebytes Trojan.MalPack.PNG.Generic
TrendMicro-HouseCall TROJ_GEN.R011C0DC423
Tencent Msil.Trojan-Spy.Snakelogger.Wimw
Yandex Trojan.Kryptik!9Vod17hFH+Q
SentinelOne Static AI - Malicious PE
Fortinet MSIL/Strictor.275740!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
file C:\Windows\SysWOW64\wscript.exe
file C:\Windows\System32\cmd.exe