Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 2, 2023, 9:20 a.m.	June 2, 2023, 9:22 a.m.

Size	434.1KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`cc23b614fd8b8174dabacc2c124742ca`
SHA256	`74cef918a24f7e55e6dd275460232d04b26078085940ddce80fd91056cae89ec`
CRC32	`4AC8AB70`
ssdeep	`6144:1JxBp9DIek9vHPKdHPB6I1b4g1puliSnF7WvJ9PLKiGvj5:1JxBHIF9nKL7n8znFWvJ9+5`
PDB Path	HHHgVPL.pdb
Yara	IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature ConfuserEx_Zero - Confuser .NET

Nano.exe "C:\Users\test22\AppData\Local\Temp\Nano.exe"
1460
- CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2116

Name	Response	Post-Analysis Lookup
ezemnia3.ddns.net	A 197.210.227.232	197.210.227.232

IP Address	Status	Action
197.210.227.232	Active	Moloch
91.193.75.178	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:50800 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.103:64894 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 2, 2023, 9:20 a.m.			0	0
IsDebuggerPresent June 2, 2023, 9:20 a.m.			0	0
IsDebuggerPresent June 2, 2023, 9:20 a.m.			0	0
IsDebuggerPresent June 2, 2023, 9:20 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

HHHgVPL.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 2, 2023, 9:20 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 event)

domain

ezemnia3.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 90 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f89000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f8e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 2116 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 2116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003e600', u'virtual_address': u'0x00002000', u'entropy': 7.8223343449214, u'name': u'.text', u'virtual_size': u'0x0003e540'}

entropy

7.82233434492

description

A section with a high entropy has been found

entropy

0.599759615385

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 2, 2023, 9:20 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (1 event)

host

91.193.75.178

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 2116 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000218	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 2, 2023, 9:20 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

CasPol.exe tried to sleep 5088024691 seconds, actually delayed analysis time by 5088024691 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host

reg_value

C:\Program Files (x86)\SMTP Host\smtphost.exe

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x0000000000400000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: à7 base_address: 0x0000000000420000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2116 process_handle: 0x0000000000000218	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x0000000000400000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 resumed a thread in remote process 2116
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000000000000214 suspend_count: 1 process_identifier: 2116	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownloaderNET.345
MicroWorld-eScan	Gen:Variant.Tedy.377082
Malwarebytes	Trojan.Crypt
VIPRE	Gen:Variant.Tedy.377082
Sangfor	Suspicious.Win32.Save.a
Arcabit	Trojan.Tedy.D5C0FA
VirIT	Trojan.Win64.MSIL_Heur.A
Cyren	W64/MSIL_Kryptik.IYE.gen!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.AIQH
Kaspersky	VHO:Trojan-Spy.MSIL.Noon.gen
BitDefender	Gen:Variant.Tedy.377082
Avast	PWSX-gen [Trj]
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:i/0+L2m2PxXzGRsvIe4kJQ)
Emsisoft	Gen:Variant.Tedy.377082 (B)
FireEye	Gen:Variant.Tedy.377082
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	VHO:Trojan-Spy.MSIL.Noon.gen
GData	Gen:Variant.Tedy.377082
Google	Detected
Ikarus	Trojan.Inject
Fortinet	MSIL/Kryptik.AHQB!tr
AVG	PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (D)

Executed a process and injected code into it, probably while unpacking (33 events)

Time & API	Arguments	Status	Return
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000000000000174 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000000000001dc suspend_count: 1 process_identifier: 1460	1	0
NtGetContextThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000000000001f0 suspend_count: 1 process_identifier: 1460	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000000000000204 suspend_count: 1 process_identifier: 1460	1	0
CreateProcessInternalW June 2, 2023, 9:20 a.m.	thread_identifier: 2120 thread_handle: 0x0000000000000214 process_identifier: 2116 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000218	1	1
NtAllocateVirtualMemory June 2, 2023, 9:20 a.m.	process_identifier: 2116 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000218	1	0
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ base_address: 0x0000000000400000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: base_address: 0x0000000000402000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: à7 base_address: 0x0000000000420000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: base_address: 0x0000000000422000 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
WriteProcessMemory June 2, 2023, 9:20 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2116 process_handle: 0x0000000000000218	1	1
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000000000000214 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x000001d4 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000308 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x0000031c suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000358 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x000003c4 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x000003d8 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000408 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:20 a.m.	thread_handle: 0x00000420 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:21 a.m.	thread_handle: 0x0000042c suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:21 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:21 a.m.	thread_handle: 0x00000470 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:22 a.m.	thread_handle: 0x0000048c suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:22 a.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 2116	1	0
NtResumeThread June 2, 2023, 9:22 a.m.	thread_handle: 0x000004b4 suspend_count: 1 process_identifier: 2116	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	91.193.75.178:62335
dead_host	192.168.56.103:49169
dead_host	192.168.56.103:49170
dead_host	197.210.227.232:62335
dead_host	192.168.56.103:49168

Nano.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All