Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 28, 2023, 8:13 a.m.	March 28, 2023, 8:15 a.m.

Size	295.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`4ef3bfe67588ffebb595fce72889a5ad`
SHA256	`5022496f74264b58155147c5db68f7f6d0396d6c8f4d68e788209a042480a6d1`
CRC32	`AD543B4B`
ssdeep	`3072:4RErAY54db0bOWl3BN+bFw3EzoZmdEq+B9C6GzlPIOXHt:4qrAY6db0CWl3hEzoWEqNJIOXH`
Yara	UPX_Zero - UPX packed file Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature

dk.exe "C:\Users\test22\AppData\Local\Temp\dk.exe"
2544
- dk.exe "C:\Users\test22\AppData\Local\Temp\dk.exe"
  2608

Name	Response	Post-Analysis Lookup
www.marex.promo	A 91.189.114.25	91.189.114.25
www.coba.dev	CNAME coba.dev A 46.17.173.192	46.17.173.192
www.meandclementina.com	CNAME meandclementina.com A 195.110.124.133	195.110.124.133
www.lowcome.life	A 198.177.124.57	198.177.124.57
www.starauctioneerspro.com	A 54.38.220.85	94.23.162.163
www.kunimi.org	A 219.94.129.181 CNAME kunimi.org	219.94.129.181
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.organiclifestyle.biz	CNAME gcdn0.wixdns.net A 34.117.168.233 CNAME td-ccm-168-233.wixdns.net	34.117.168.233

IP Address	Status	Action
164.124.101.2	Active	Moloch
195.110.124.133	Active	Moloch
198.177.124.57	Active	Moloch
219.94.129.181	Active	Moloch
34.117.168.233	Active	Moloch
45.33.6.223	Active	Moloch
46.17.173.192	Active	Moloch
54.38.220.85	Active	Moloch
91.189.114.25	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
UDP 192.168.56.101:54883 -> 164.124.101.2:53	2027867	ET INFO Observed DNS Query to .life TLD	Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 198.177.124.57:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 198.177.124.57:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.101:49179 -> 198.177.124.57:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 34.117.168.233:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.117.168.233:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.117.168.233:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 54.38.220.85:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 195.110.124.133:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 91.189.114.25:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 54.38.220.85:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 195.110.124.133:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 91.189.114.25:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 195.110.124.133:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 54.38.220.85:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 91.189.114.25:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 46.17.173.192:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 46.17.173.192:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 46.17.173.192:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 219.94.129.181:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 219.94.129.181:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 219.94.129.181:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 198.177.124.57:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 198.177.124.57:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 198.177.124.57:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 198.177.124.57:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 28, 2023, 8:13 a.m.			0	0
IsDebuggerPresent March 28, 2023, 8:13 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 28, 2023, 8:13 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (7 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.organiclifestyle.biz/u62a/?q--kx9Ef=VvqZGz3PHJbSx1QTtGtZ27JbTMCS5Ic5/4p6o7fkYDsqsQXV00C4Mjy3HEa1fsrCkNg75FGvKvR0eCFVX6t17fJz0m/poFYbzV0qA3k=&El=z7Vjn
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.coba.dev/u62a/?q--kx9Ef=o8SCP/YnJ49qk75I5z3GzELHmg2Up2LUiNCn13SbmA4goaf+g+1fYa13Odsfun9rvkIDAdpJippA+Y6N0xwu8NBanTjMGd5U2PfRiS4=&El=z7Vjn
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.meandclementina.com/u62a/?q--kx9Ef=sEdvL1ZGkULv2A8bNXBRaRmdYx+eWL4gYtShFj4pbN8o5eHSa3QtYRl1ZjlPIya8jQvOFXB8wZUlu2C2FpqSzuYXIQNHQFur3PZxkFI=&El=z7Vjn
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.marex.promo/u62a/?q--kx9Ef=HTOKBE+ideXsbClCFIZFlPYDAjUuWFn3t4knnx885+0EkjdUagvAPmmh9nOXJS6XsZrvZ1YpL3hurMR7Bu4FKovUyILBMkHn6uQL+64=&El=z7Vjn
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.starauctioneerspro.com/u62a/?q--kx9Ef=xxICz6/4R5ldvKit9pQiZZ+jTsTJ1UXO3+kkY3b4PoRSc/9CGhnte6tVjQSTVfHBpnO/T6bLIQt5I4s4artxGH6TeZHS/DCwG7N4VUA=&El=z7Vjn
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.lowcome.life/u62a/?q--kx9Ef=SpYuczb0I67O/JB79loYgv0QPNy9tmAedxSPiGXP/gajLTktWHzWDdz7w0u65687mA4BdpaJEcNqadlvkC0xWpASIIM+xKCPpUlgMWA=&El=z7Vjn
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.kunimi.org/u62a/?q--kx9Ef=Do2YNZmdCCnGDS2WdMJQZ6ZCKAd/GRXgo7DNSK9yFY09r/FIwMWpAWGLeKjsO9QXj5EgxT/2XN8JUIdJtTBe0orCvwywWdiUJLw1V4E=&El=z7Vjn

Performs some HTTP requests (14 events)

request	GET http://www.organiclifestyle.biz/u62a/?q--kx9Ef=VvqZGz3PHJbSx1QTtGtZ27JbTMCS5Ic5/4p6o7fkYDsqsQXV00C4Mjy3HEa1fsrCkNg75FGvKvR0eCFVX6t17fJz0m/poFYbzV0qA3k=&El=z7Vjn
request	GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3320000.zip
request	POST http://www.coba.dev/u62a/
request	GET http://www.coba.dev/u62a/?q--kx9Ef=o8SCP/YnJ49qk75I5z3GzELHmg2Up2LUiNCn13SbmA4goaf+g+1fYa13Odsfun9rvkIDAdpJippA+Y6N0xwu8NBanTjMGd5U2PfRiS4=&El=z7Vjn
request	POST http://www.meandclementina.com/u62a/
request	GET http://www.meandclementina.com/u62a/?q--kx9Ef=sEdvL1ZGkULv2A8bNXBRaRmdYx+eWL4gYtShFj4pbN8o5eHSa3QtYRl1ZjlPIya8jQvOFXB8wZUlu2C2FpqSzuYXIQNHQFur3PZxkFI=&El=z7Vjn
request	POST http://www.marex.promo/u62a/
request	GET http://www.marex.promo/u62a/?q--kx9Ef=HTOKBE+ideXsbClCFIZFlPYDAjUuWFn3t4knnx885+0EkjdUagvAPmmh9nOXJS6XsZrvZ1YpL3hurMR7Bu4FKovUyILBMkHn6uQL+64=&El=z7Vjn
request	POST http://www.starauctioneerspro.com/u62a/
request	GET http://www.starauctioneerspro.com/u62a/?q--kx9Ef=xxICz6/4R5ldvKit9pQiZZ+jTsTJ1UXO3+kkY3b4PoRSc/9CGhnte6tVjQSTVfHBpnO/T6bLIQt5I4s4artxGH6TeZHS/DCwG7N4VUA=&El=z7Vjn
request	POST http://www.lowcome.life/u62a/
request	GET http://www.lowcome.life/u62a/?q--kx9Ef=SpYuczb0I67O/JB79loYgv0QPNy9tmAedxSPiGXP/gajLTktWHzWDdz7w0u65687mA4BdpaJEcNqadlvkC0xWpASIIM+xKCPpUlgMWA=&El=z7Vjn
request	POST http://www.kunimi.org/u62a/
request	GET http://www.kunimi.org/u62a/?q--kx9Ef=Do2YNZmdCCnGDS2WdMJQZ6ZCKAd/GRXgo7DNSK9yFY09r/FIwMWpAWGLeKjsO9QXj5EgxT/2XN8JUIdJtTBe0orCvwywWdiUJLw1V4E=&El=z7Vjn

Sends data using the HTTP POST Method (6 events)

request	POST http://www.coba.dev/u62a/
request	POST http://www.meandclementina.com/u62a/
request	POST http://www.marex.promo/u62a/
request	POST http://www.starauctioneerspro.com/u62a/
request	POST http://www.lowcome.life/u62a/
request	POST http://www.kunimi.org/u62a/

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 188416 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c130b process_handle: 0xffffffff		3221225713
NtAllocateVirtualMemory March 28, 2023, 8:14 a.m.	process_identifier: 2608 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00032e00', u'virtual_address': u'0x00002000', u'entropy': 7.934534198844071, u'name': u'.text', u'virtual_size': u'0x00032d1f'}

entropy

7.93453419884

description

A section with a high entropy has been found

entropy

0.691001697793

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 28, 2023, 8:14 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2608 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278		3221225496	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2608 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 28, 2023, 8:13 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}õ}õ}Ò»Íö}Ò»Ïô}Ò»Îô}Richõ}PEL¹ªGàÔàð@ð@.text¤ÓÔ ` base_address: 0x000c0000 process_identifier: 2608 process_handle: 0x00000278	1	1	0
WriteProcessMemory March 28, 2023, 8:13 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2608 process_handle: 0x00000278	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 28, 2023, 8:13 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}õ}õ}Ò»Íö}Ò»Ïô}Ò»Îô}Richõ}PEL¹ªGàÔàð@ð@.text¤ÓÔ ` base_address: 0x000c0000 process_identifier: 2608 process_handle: 0x00000278	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 called NtSetContextThread to modify thread in remote process 2608
NtSetContextThread March 28, 2023, 8:13 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199136 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000274 process_identifier: 2608	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 resumed a thread in remote process 2608
NtResumeThread March 28, 2023, 8:13 a.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2608	1	0	0

Executed a process and injected code into it, probably while unpacking (12 events)

Time & API	Arguments	Status	Return
NtResumeThread March 28, 2023, 8:13 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread March 28, 2023, 8:13 a.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread March 28, 2023, 8:13 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2544	1	0
CreateProcessInternalW March 28, 2023, 8:13 a.m.	thread_identifier: 2612 thread_handle: 0x00000274 process_identifier: 2608 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\dk.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\dk.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\dk.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000278	1	1
NtGetContextThread March 28, 2023, 8:13 a.m.	thread_handle: 0x00000274	1	0
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2608 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278		3221225496
NtAllocateVirtualMemory March 28, 2023, 8:13 a.m.	process_identifier: 2608 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0
WriteProcessMemory March 28, 2023, 8:13 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}õ}õ}Ò»Íö}Ò»Ïô}Ò»Îô}Richõ}PEL¹ªGàÔàð@ð@.text¤ÓÔ ` base_address: 0x000c0000 process_identifier: 2608 process_handle: 0x00000278	1	1
WriteProcessMemory March 28, 2023, 8:13 a.m.	buffer: base_address: 0x000c1000 process_identifier: 2608 process_handle: 0x00000278	1	1
WriteProcessMemory March 28, 2023, 8:13 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2608 process_handle: 0x00000278	1	1
NtSetContextThread March 28, 2023, 8:13 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199136 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000274 process_identifier: 2608	1	0
NtResumeThread March 28, 2023, 8:13 a.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2608	1	0

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Barys.15006
CAT-QuickHeal	Trojan.Generic
ALYac	Gen:Variant.Barys.15006
Malwarebytes	Trojan.Crypt.MSIL
VIPRE	Gen:Variant.Barys.15006
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:MSIL/Kryptik.7bc0a7f3
Arcabit	Trojan.Barys.D3A9E
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AGWQ
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Gen:Variant.Barys.15006
Avast	Win32:RATX-gen [Trj]
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:93uEqFpNURVO90XTKVzW0A)
TrendMicro	TROJ_GEN.R06FC0WCQ23
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1305736
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/Leonem
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Gen:Variant.Barys.15006
Google	Detected
McAfee	Artemis!4EF3BFE67588
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R06FC0WCQ23
Tencent	Win32.Trojan.Generic.Qwhl
Ikarus	Trojan.MSIL.Inject
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AEBO!tr
BitDefenderTheta	Gen:NN.ZemsilF.36344.sm0@a8d4WhaG
AVG	Win32:RATX-gen [Trj]
Panda	Trj/GdSda.A

dk.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All