Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 24, 2023, 9:34 a.m.	March 24, 2023, 9:38 a.m.

Size	1.9MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`3951f8ad7e0e7682fc0d9d13c9a503c5`
SHA256	`f40dd6641748b834786cd41cbe281266218d3e5ff56257a30dcafc9c90cee1bf`
CRC32	`32824939`
ssdeep	`49152:crQCvSTb40i4oH2gyBw1ne0a60Os+nEm3oI2FNMy:IlSDI2fQe0ls+EtM`
PDB Path	wextract.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file IsPE64 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

LitPay.exe "C:\Users\test22\AppData\Local\Temp\LitPay.exe"
2552
- system!.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\system!.exe
  2604
- MICROS~1.EXE C:\Users\test22\AppData\Local\Temp\IXP000.TMP\MICROS~1.EXE
  2752

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 24, 2023, 9:33 a.m.			0	0
IsDebuggerPresent March 24, 2023, 9:33 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 24, 2023, 9:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052b1c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 9:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052b1c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 24, 2023, 9:33 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052b240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 24, 2023, 9:33 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 24, 2023, 9:33 a.m.	stacktrace: SetInputScope+0x38ff DllRegisterServer-0x11cc1 msctf+0x2d47f @ 0x7fefee7d47f CtfImeInquireExW+0xf4e TF_GetInputScope-0x6b6 msctf+0x12b22 @ 0x7fefee62b22 CtfImeInquireExW+0xb49 TF_GetInputScope-0xabb msctf+0x1271d @ 0x7fefee6271d CtfImeInquireExW+0xadc TF_GetInputScope-0xb28 msctf+0x126b0 @ 0x7fefee626b0 CtfImeInquireExW+0xdd9 TF_GetInputScope-0x82b msctf+0x129ad @ 0x7fefee629ad CtfImeInquireExW+0x10ee TF_GetInputScope-0x516 msctf+0x12cc2 @ 0x7fefee62cc2 CtfImeAssociateFocus+0x19c CtfImeSelectEx-0x352c msctf+0x39c8 @ 0x7fefee539c8 CtfImeAssociateFocus+0x4e CtfImeSelectEx-0x367a msctf+0x387a @ 0x7fefee5387a ImmSetActiveContext+0xba ImmUnlockClientImc-0xc2 imm32+0x1c0e @ 0x7fefd5e1c0e SetWindowPos+0x88 ChangeWindowMessageFilterEx-0x9d8 user32+0x13cd8 @ 0x769c3cd8 RegisterClassExW+0x21e LoadCursorW-0x3de user32+0x110ba @ 0x769c10ba RegisterClassExW+0x1ab LoadCursorW-0x451 user32+0x11047 @ 0x769c1047 RegisterClassExW+0x2fa LoadCursorW-0x302 user32+0x11196 @ 0x769c1196 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1 SetWindowTextW+0x277 SetWindowLongPtrW-0x3f5 user32+0x172cb @ 0x769c72cb IsDialogMessageW+0x169 SetTimer-0x107 user32+0x16829 @ 0x769c6829 KiUserCallbackDispatcher+0x1f KiUserExceptionDispatcher-0x25 ntdll+0x51225 @ 0x76d81225 SetWindowPos+0xa ChangeWindowMessageFilterEx-0xa56 user32+0x13c5a @ 0x769c3c5a system!+0x4ef9 @ 0x13f574ef9 system!+0x3b6f @ 0x13f573b6f GetMenuStringW+0x23b TrackPopupMenuEx-0x10d1 user32+0x2608f @ 0x769d608f CreateDialogParamW+0x276 MapVirtualKeyA-0x5e6 user32+0x27792 @ 0x769d7792 ReuseDDElParam+0x161 IsDialogMessage-0x17 user32+0x53251 @ 0x76a03251 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1 GetMenuStringW+0x375 TrackPopupMenuEx-0xf97 user32+0x261c9 @ 0x769d61c9 GetComboBoxInfo+0x473 DialogBoxIndirectParamAorW-0x39 user32+0x24ec3 @ 0x769d4ec3 DialogBoxIndirectParamAorW+0x56 DialogBoxIndirectParamW-0x1e user32+0x24f52 @ 0x769d4f52 DialogBoxIndirectParamA+0x1b CreateDialogIndirectParamA-0xd user32+0x42bff @ 0x769f2bff system!+0x7da6 @ 0x13f577da6 system!+0x3428 @ 0x13f573428 system!+0x2e07 @ 0x13f572e07 system!+0x862f @ 0x13f57862f BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: ff 50 18 4c 8b 5c 24 78 41 03 f6 49 03 fe 3b b5 exception.symbol: SetInputScope+0x38ff DllRegisterServer-0x11cc1 msctf+0x2d47f exception.instruction: call qword ptr [rax + 0x18] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 185471 exception.address: 0x7fefee7d47f registers.r14: 0 registers.r15: 0 registers.rcx: 2995408 registers.rsi: 0 registers.r10: 8791780181856 registers.rbx: 0 registers.rsp: 2423680 registers.r11: 3707680 registers.r8: 1 registers.r9: 3707680 registers.rdx: 3599072 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1950589960 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 24, 2023, 9:33 a.m.

stacktrace:

SetInputScope+0x38ff DllRegisterServer-0x11cc1 msctf+0x2d47f @ 0x7fefee7d47f
CtfImeInquireExW+0xf4e TF_GetInputScope-0x6b6 msctf+0x12b22 @ 0x7fefee62b22
CtfImeInquireExW+0xb49 TF_GetInputScope-0xabb msctf+0x1271d @ 0x7fefee6271d
CtfImeInquireExW+0xadc TF_GetInputScope-0xb28 msctf+0x126b0 @ 0x7fefee626b0
CtfImeInquireExW+0xdd9 TF_GetInputScope-0x82b msctf+0x129ad @ 0x7fefee629ad
CtfImeInquireExW+0x10ee TF_GetInputScope-0x516 msctf+0x12cc2 @ 0x7fefee62cc2
CtfImeAssociateFocus+0x19c CtfImeSelectEx-0x352c msctf+0x39c8 @ 0x7fefee539c8
CtfImeAssociateFocus+0x4e CtfImeSelectEx-0x367a msctf+0x387a @ 0x7fefee5387a
ImmSetActiveContext+0xba ImmUnlockClientImc-0xc2 imm32+0x1c0e @ 0x7fefd5e1c0e
SetWindowPos+0x88 ChangeWindowMessageFilterEx-0x9d8 user32+0x13cd8 @ 0x769c3cd8
RegisterClassExW+0x21e LoadCursorW-0x3de user32+0x110ba @ 0x769c10ba
RegisterClassExW+0x1ab LoadCursorW-0x451 user32+0x11047 @ 0x769c1047
RegisterClassExW+0x2fa LoadCursorW-0x302 user32+0x11196 @ 0x769c1196
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
SetWindowTextW+0x277 SetWindowLongPtrW-0x3f5 user32+0x172cb @ 0x769c72cb
IsDialogMessageW+0x169 SetTimer-0x107 user32+0x16829 @ 0x769c6829
KiUserCallbackDispatcher+0x1f KiUserExceptionDispatcher-0x25 ntdll+0x51225 @ 0x76d81225
SetWindowPos+0xa ChangeWindowMessageFilterEx-0xa56 user32+0x13c5a @ 0x769c3c5a
system!+0x4ef9 @ 0x13f574ef9
system!+0x3b6f @ 0x13f573b6f
GetMenuStringW+0x23b TrackPopupMenuEx-0x10d1 user32+0x2608f @ 0x769d608f
CreateDialogParamW+0x276 MapVirtualKeyA-0x5e6 user32+0x27792 @ 0x769d7792
ReuseDDElParam+0x161 IsDialogMessage-0x17 user32+0x53251 @ 0x76a03251
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
GetMenuStringW+0x375 TrackPopupMenuEx-0xf97 user32+0x261c9 @ 0x769d61c9
GetComboBoxInfo+0x473 DialogBoxIndirectParamAorW-0x39 user32+0x24ec3 @ 0x769d4ec3
DialogBoxIndirectParamAorW+0x56 DialogBoxIndirectParamW-0x1e user32+0x24f52 @ 0x769d4f52
DialogBoxIndirectParamA+0x1b CreateDialogIndirectParamA-0xd user32+0x42bff @ 0x769f2bff
system!+0x7da6 @ 0x13f577da6
system!+0x3428 @ 0x13f573428
system!+0x2e07 @ 0x13f572e07
system!+0x862f @ 0x13f57862f
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: ff 50 18 4c 8b 5c 24 78 41 03 f6 49 03 fe 3b b5
exception.symbol: SetInputScope+0x38ff DllRegisterServer-0x11cc1 msctf+0x2d47f
exception.instruction: call qword ptr [rax + 0x18]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 185471
exception.address: 0x7fefee7d47f
registers.r14: 0
registers.r15: 0
registers.rcx: 2995408
registers.rsi: 0
registers.r10: 8791780181856
registers.rbx: 0
registers.rsp: 2423680
registers.r11: 3707680
registers.r8: 1
registers.r9: 3707680
registers.rdx: 3599072
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1950589960
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0065f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 90112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fa3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fa9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00faa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:33 a.m.	process_identifier: 2752 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00fab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\afcfj\eckb.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\system!.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\MICROS~1.EXE

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\afcfj\eckb.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001de000', u'virtual_address': u'0x0000f000', u'entropy': 7.984785233548823, u'name': u'.rsrc', u'virtual_size': u'0x001de000'}

entropy

7.98478523355

description

A section with a high entropy has been found

entropy

0.971544715447

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 24, 2023, 9:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\eckb				reg_value	C:\Users\test22\AppData\Roaming\afcfj\eckb.exe

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

MicroWorld-eScan	Gen:Variant.MSILHeracles.67531
ALYac	Gen:Variant.Marsilia.29066
Malwarebytes	MachineLearning/Anomalous.100%
CrowdStrike	win/malicious_confidence_70% (D)
Cyren	W64/MSIL_Agent.EYC.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
Avast	Win64:CrypterX-gen [Trj]
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.Inject4.30867
VIPRE	Gen:Variant.MSILHeracles.67531
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.3951f8ad7e0e7682
Ikarus	Malware.Win32.PureMiner
Avira	TR/Dropper.MSIL.Gen
Microsoft	Trojan:Win32/Sonbokli.A!cl
Google	Detected
Cylance	unsafe
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:+ylnmBHdfgMkFbNpVjIxKw)
SentinelOne	Static AI - Malicious SFX
AVG	Win64:CrypterX-gen [Trj]

LitPay.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All