Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 30, 2023, 4:23 p.m.	May 30, 2023, 4:25 p.m.

Size	827.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`4d05c10b6ba4bf4e4db1c49232f2e144`
SHA256	`ad4b09d5bd45cb28e02d15b16313813aac8db083363be6aa81d2d6e53ed97a9a`
CRC32	`906E9472`
ssdeep	`12288:L0oHJLpNaPn0YPX/N8j7rtQirUu8/hs97oo4gJNgzNqAAvXHdWXXkGIqfn8ySTLF:woH8P03fpFA/yCBSgcHv82mnbSTL`
PDB Path	GIjm.pdb
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE32 - (no description)

Kimball Electronics PO NO4503269204.exe "C:\Users\test22\AppData\Local\Temp\Kimball Electronics PO NO4503269204.exe"
2560
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\DnOkltoRw.exe"
  2956
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp"
  3004
- Kimball Electronics PO NO4503269204.exe "C:\Users\test22\AppData\Local\Temp\Kimball Electronics PO NO4503269204.exe"
  812

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
194.180.48.58	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49171 -> 194.180.48.58:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 194.180.48.58:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 194.180.48.58:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.101:49168 -> 194.180.48.58:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 194.180.48.58:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.101:49172 -> 194.180.48.58:80	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 194.180.48.58:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 194.180.48.58:80	2025381	ET MALWARE LokiBot Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 194.180.48.58:80	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 194.180.48.58:80	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 194.180.48.58:80	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 194.180.48.58:80	2024317	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 194.180.48.58:80	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 194.180.48.58:80	2024317	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2	A Network Trojan was detected
TCP 194.180.48.58:80 -> 192.168.56.101:49171	2025483	ET MALWARE LokiBot Fake 404 Response	A Network Trojan was detected
TCP 192.168.56.101:49172 -> 194.180.48.58:80	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 194.180.48.58:80	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	Malware Command and Control Activity Detected
TCP 194.180.48.58:80 -> 192.168.56.101:49172	2025483	ET MALWARE LokiBot Fake 404 Response	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 30, 2023, 4:23 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 30, 2023, 4:23 p.m.			0	0
IsDebuggerPresent May 30, 2023, 4:23 p.m.			0	0
IsDebuggerPresent May 30, 2023, 4:23 p.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\DnOklto console_handle: 0x00000053	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: Rw.exe console_handle: 0x0000005f	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW May 30, 2023, 4:23 p.m.	buffer: SUCCESS: The scheduled task "Updates\DnOkltoRw" has successfully been created. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066feb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066ffb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066ffb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066ffb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066ffb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066ffb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066ffb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fa78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fa78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fa78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066fbb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 30, 2023, 4:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00670838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

GIjm.pdb

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 30, 2023, 4:23 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 30, 2023, 4:23 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72951194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72822ba1 system+0x1b3792 @ 0x71013792 system+0x1b34c4 @ 0x710134c4 system+0x1b348c @ 0x7101348c system+0x1b3161 @ 0x71013161 system+0x1b2e69 @ 0x71012e69 system+0x1b2c27 @ 0x71012c27 system+0x1c0751 @ 0x71020751 0x61b5f9e 0x61b2af8 0x68eaee mscorlib+0xd3689c @ 0x7251689c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x7293a6d8 CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x7293a737 PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x7291ec81 PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x7291ed29 mscorlib+0x389e52 @ 0x71b69e52 mscorlib+0x309c30 @ 0x71ae9c30 mscorlib+0x2eb9eb @ 0x71acb9eb mscorlib+0x2d7cd5 @ 0x71ab7cd5 mscorlib+0x2d77bd @ 0x71ab77bd mscorlib+0x2d74ff @ 0x71ab74ff mscorlib+0x2d71c3 @ 0x71ab71c3 mscorlib+0x2d48ea @ 0x71ab48ea mscorlib+0x35a8e9 @ 0x71b3a8e9 0x68e9e6 0x68ca1b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72821838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72821737 mscorlib+0x2d3711 @ 0x71ab3711 mscorlib+0x308f2d @ 0x71ae8f2d mscorlib+0x2cb060 @ 0x71aab060 0x6846d2 0x68462a 0x6825f2 0x68206f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72821838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72821737 mscorlib+0x305edf @ 0x71ae5edf mscorlib+0x2e9e1b @ 0x71ac9e1b mscorlib+0x2e99c1 @ 0x71ac99c1 mscorlib+0x2de184 @ 0x71abe184 0x68149c 0x68022b 0x68008b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2543820 registers.edi: 0 registers.eax: 2543820 registers.ebp: 2543900 registers.edx: 0 registers.ebx: 97320840 registers.esi: 4081648 registers.ecx: 3043616298	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 30, 2023, 4:23 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72951194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72822ba1
system+0x1b3792 @ 0x71013792
system+0x1b34c4 @ 0x710134c4
system+0x1b348c @ 0x7101348c
system+0x1b3161 @ 0x71013161
system+0x1b2e69 @ 0x71012e69
system+0x1b2c27 @ 0x71012c27
system+0x1c0751 @ 0x71020751
0x61b5f9e
0x61b2af8
0x68eaee
mscorlib+0xd3689c @ 0x7251689c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95
CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x7293a6d8
CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x7293a737
PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x7291ec81
PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x7291ed29
mscorlib+0x389e52 @ 0x71b69e52
mscorlib+0x309c30 @ 0x71ae9c30
mscorlib+0x2eb9eb @ 0x71acb9eb
mscorlib+0x2d7cd5 @ 0x71ab7cd5
mscorlib+0x2d77bd @ 0x71ab77bd
mscorlib+0x2d74ff @ 0x71ab74ff
mscorlib+0x2d71c3 @ 0x71ab71c3
mscorlib+0x2d48ea @ 0x71ab48ea
mscorlib+0x35a8e9 @ 0x71b3a8e9
0x68e9e6
0x68ca1b
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72821838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72821737
mscorlib+0x2d3711 @ 0x71ab3711
mscorlib+0x308f2d @ 0x71ae8f2d
mscorlib+0x2cb060 @ 0x71aab060
0x6846d2
0x68462a
0x6825f2
0x68206f
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72821838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72821737
mscorlib+0x305edf @ 0x71ae5edf
mscorlib+0x2e9e1b @ 0x71ac9e1b
mscorlib+0x2e99c1 @ 0x71ac99c1
mscorlib+0x2de184 @ 0x71abe184
0x68149c
0x68022b
0x68008b
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7415f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741d7f16

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 2543820
registers.edi: 0
registers.eax: 2543820
registers.ebp: 2543900
registers.edx: 0
registers.ebx: 97320840
registers.esi: 4081648
registers.ecx: 3043616298

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, HTTP version 1.0 used, Connection to IP address

suspicious_request

POST http://194.180.48.58/blessedjay/five/fre.php

Performs some HTTP requests (1 event)

request

POST http://194.180.48.58/blessedjay/five/fre.php

Sends data using the HTTP POST Method (1 event)

request

POST http://194.180.48.58/blessedjay/five/fre.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 185 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00586000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00681000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00683000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00684000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f7f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00687000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00688000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2956 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 2956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (19 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\DnOkltoRw.exe"
cmdline	schtasks.exe /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp"
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\DnOkltoRw.exe"

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 30, 2023, 4:23 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\DnOkltoRw.exe" filepath: powershell	1	1	0
ShellExecuteExW May 30, 2023, 4:23 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp" filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ce200', u'virtual_address': u'0x00002000', u'entropy': 7.270198530590508, u'name': u'.text', u'virtual_size': u'0x000ce198'}

entropy

7.27019853059

description

A section with a high entropy has been found

entropy

0.99758015729

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 30, 2023, 4:23 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 4:23 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 30, 2023, 4:23 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.ibsensoftware.com/

Yara rule detected in process memory (12 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications use DNS	rule	Network_DNS
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp"
cmdline	schtasks.exe /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp"

Communicates with host for which no DNS query was performed (1 event)

host

194.180.48.58

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 812 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003a0	1	0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp

Harvests credentials from local FTP client softwares (22 events)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\test22\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 812 process_handle: 0x000003a0	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 812 process_handle: 0x000003a0	1	1	0

Harvests credentials from local email clients (3 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 called NtSetContextThread to modify thread in remote process 812
NtSetContextThread May 30, 2023, 4:23 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000398 process_identifier: 812	1	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2560 resumed a thread in remote process 812
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000398 suspend_count: 1 process_identifier: 812	1	0	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Executed a process and injected code into it, probably while unpacking (32 events)

Time & API	Arguments	Status	Return
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2560	1	0
CreateProcessInternalW May 30, 2023, 4:23 p.m.	thread_identifier: 2960 thread_handle: 0x000003e4 process_identifier: 2956 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\DnOkltoRw.exe" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003ec	1	1
CreateProcessInternalW May 30, 2023, 4:23 p.m.	thread_identifier: 3008 thread_handle: 0x000003a4 process_identifier: 3004 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DnOkltoRw" /XML "C:\Users\test22\AppData\Local\Temp\tmp9EBB.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003ec	1	1
NtGetContextThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000150	1	0
NtGetContextThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000150	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2560	1	0
NtGetContextThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread May 30, 2023, 4:23 p.m.	registers.eip: 1921133444 registers.esp: 2544028 registers.edi: 257 registers.eax: 43534332 registers.ebp: 2544048 registers.edx: 119 registers.ebx: 43534140 registers.esi: 8 registers.ecx: 5658256 thread_handle: 0x000000e4 process_identifier: 2560	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2560	1	0
CreateProcessInternalW May 30, 2023, 4:23 p.m.	thread_identifier: 2056 thread_handle: 0x00000398 process_identifier: 812 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Kimball Electronics PO NO4503269204.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Kimball Electronics PO NO4503269204.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003a0	1	1
NtGetContextThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000398	1	0
NtAllocateVirtualMemory May 30, 2023, 4:23 p.m.	process_identifier: 812 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003a0	1	0
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À base_address: 0x00400000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: base_address: 0x00401000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: base_address: 0x00415000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: TÍ<¨K¢`Ý;U base_address: 0x0041a000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: base_address: 0x004a0000 process_identifier: 812 process_handle: 0x000003a0	1	1
WriteProcessMemory May 30, 2023, 4:23 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 812 process_handle: 0x000003a0	1	1
NtSetContextThread May 30, 2023, 4:23 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000398 process_identifier: 812	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000398 suspend_count: 1 process_identifier: 812	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000003e4 suspend_count: 1 process_identifier: 2560	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x000004a8 suspend_count: 1 process_identifier: 2956	1	0
NtResumeThread May 30, 2023, 4:23 p.m.	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 812	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Lionic	Trojan.Win32.Crypt.4!c
DrWeb	Trojan.Siggen20.54616
MicroWorld-eScan	Trojan.GenericKD.67117828
FireEye	Trojan.GenericKD.67117828
McAfee	Artemis!4D05C10B6BA4
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vayv
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Arcabit	Trojan.Generic.D4002304
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Agent.FKN.gen!Eldorado
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GJZH
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.67117828
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan.Crypt.Uimw
Emsisoft	Trojan.GenericKD.67117828 (B)
VIPRE	Trojan.GenericKD.67117828
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Androm
Gridinsoft	Trojan.Win32.Kryptik.cl
Microsoft	Trojan:MSIL/LokiBot.TG!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.67117828
Google	Detected
AhnLab-V3	Trojan/Win.PWSX-gen.C5430452
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.PNG.Generic
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.F0D1C00EJ23
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:OqRRtcWiQOhUhxJuDpZI7A)
Yandex	Trojan.Igent.bZ99QF.7
Ikarus	Trojan-Spy.AgentTesla
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GJDR!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Kimball Electronics PO NO4503269204.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All