Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 8, 2023, 9:22 a.m.	June 8, 2023, 9:25 a.m.

Size	677.6KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`99e770cd68e71c4e1fff20ffbb325624`
SHA256	`5460fc226b1d4fe8e3d5c11e4afcd3b4ee67ccc9725ac71d27d6e1a5ea36f1d2`
CRC32	`45A3C98E`
ssdeep	`12288:GPORb5mro/FU40YNACDNctdksV0PamruuYYppEMd1pFrptRrrgw960Q:GPOTFU40YNTNcblV0PRr/H1plbvs3`
PDB Path	NNnBbBb88837363.pdb
Yara	IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT ConfuserEx_Zero - Confuser .NET PE_Header_Zero - PE File Signature

Dollar.exe "C:\Users\test22\AppData\Local\Temp\Dollar.exe"
1044
- CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2132
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.212.81.157	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 8, 2023, 9:22 a.m.			0	0
IsDebuggerPresent June 8, 2023, 9:22 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

NNnBbBb88837363.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 8, 2023, 9:22 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 8, 2023, 9:22 a.m.	stacktrace: caspol+0x3738 @ 0x403738 caspol+0x12a34 @ 0x412a34 caspol+0x1570a @ 0x41570a caspol+0x5ea7 @ 0x405ea7 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7 exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118 exception.instruction: movzx eax, word ptr [ecx] exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 209176 exception.address: 0x75813118 registers.esp: 3208792 registers.edi: 3208924 registers.eax: 3208816 registers.ebp: 3208832 registers.edx: 9240576 registers.ebx: 0 registers.esi: 3209088 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (49 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c4b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35b4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f65000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f67000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f68000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f69000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000064e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000a3000', u'virtual_address': u'0x00002000', u'entropy': 7.932912349971621, u'name': u'.text', u'virtual_size': u'0x000a2e60'}

entropy

7.93291234997

description

A section with a high entropy has been found

entropy

0.988627748294

description

Overall entropy of this PE file is high

Yara rule detected in process memory (17 events)

description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Run a KeyLogger	rule	KeyLogger

Communicates with host for which no DNS query was performed (1 event)

host

103.212.81.157

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 2132 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000022c	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x0000000000400000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: 2pçácö\ E=Ã&éÉç3Ñ®Èk.óùQ*ìèå"êéì=:ÒÆEáËäª®4\|zÛÛf?ÈùÉ[4»dåMè`qûÅñp¢pbbTMoÁ©ÀïÃåÌØb}ÿìo= ô(ßÑÙ¢SRFXý&DOÎ, base_address: 0x000000000055d000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2132 process_handle: 0x000000000000022c	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x0000000000400000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1044 resumed a thread in remote process 2132
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x0000000000000228 suspend_count: 1 process_identifier: 2132	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1044	1	0
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 1044	1	0
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x0000000000000178 suspend_count: 1 process_identifier: 1044	1	0
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x00000000000001ec suspend_count: 1 process_identifier: 1044	1	0
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x0000000000000200 suspend_count: 1 process_identifier: 1044	1	0
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x0000000000000218 suspend_count: 1 process_identifier: 1044	1	0
CreateProcessInternalW June 8, 2023, 9:22 a.m.	thread_identifier: 2136 thread_handle: 0x0000000000000228 process_identifier: 2132 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000000000022c	1	1
NtAllocateVirtualMemory June 8, 2023, 9:22 a.m.	process_identifier: 2132 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000022c	1	0
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,°à0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x0000000000400000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: base_address: 0x0000000000401000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: base_address: 0x0000000000417000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: base_address: 0x000000000041c000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: base_address: 0x000000000055b000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: 2pçácö\ E=Ã&éÉç3Ñ®Èk.óùQ*ìèå"êéì=:ÒÆEáËäª®4\|zÛÛf?ÈùÉ[4»dåMè`qûÅñp¢pbbTMoÁ©ÀïÃåÌØb}ÿìo= ô(ßÑÙ¢SRFXý&DOÎ, base_address: 0x000000000055d000 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
WriteProcessMemory June 8, 2023, 9:22 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2132 process_handle: 0x000000000000022c	1	1
NtResumeThread June 8, 2023, 9:22 a.m.	thread_handle: 0x0000000000000228 suspend_count: 1 process_identifier: 2132	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Lionic	Trojan.Win32.Noon.4!c
MicroWorld-eScan	IL:Trojan.MSILZilla.19869
McAfee	Artemis!99E770CD68E7
Malwarebytes	Trojan.Crypt
VIPRE	IL:Trojan.MSILZilla.19869
Sangfor	Spyware.Msil.Kryptik.Vn13
Alibaba	TrojanSpy:MSIL/Kryptik.d261be15
K7GW	Trojan ( 0059d5381 )
Arcabit	IL:Trojan.MSILZilla.D4D9D
VirIT	Trojan.Win64.MSIL_Heur.A
Cyren	W64/MSIL_Kryptik.IYE.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AHQJ
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	IL:Trojan.MSILZilla.19869
Avast	Win64:RATX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13c67476
Emsisoft	IL:Trojan.MSILZilla.19869 (B)
F-Secure	Heuristic.HEUR/AGEN.1325558
DrWeb	Trojan.DownloaderNET.345
TrendMicro	Backdoor.Win64.WARZONE.YXDFCZ
McAfee-GW-Edition	Artemis!Trojan
FireEye	IL:Trojan.MSILZilla.19869
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1325558
Gridinsoft	Trojan.Win64.WarzoneRAT.bot
Microsoft	Trojan:MSIL/AgentTesla.RPX!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	IL:Trojan.MSILZilla.19869
Google	Detected
AhnLab-V3	Trojan/Win.AgentTesla.C5436496
ALYac	IL:Trojan.MSILZilla.19869
MAX	malware (ai score=82)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Backdoor.Win64.WARZONE.YXDFCZ
Rising	Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:qPEuXTFhB/nVsIU2rVrqig)
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.AHQB!tr
AVG	Win64:RATX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (17 events)

dead_host	192.168.56.103:49171
dead_host	192.168.56.103:49170
dead_host	192.168.56.103:49181
dead_host	192.168.56.103:49180
dead_host	192.168.56.103:49173
dead_host	192.168.56.103:49182
dead_host	192.168.56.103:49172
dead_host	192.168.56.103:49177
dead_host	192.168.56.103:49175
dead_host	192.168.56.103:49176
dead_host	192.168.56.103:49174
dead_host	192.168.56.103:49179
dead_host	192.168.56.103:49169
dead_host	192.168.56.103:49178
dead_host	192.168.56.103:49167
dead_host	103.212.81.157:11011
dead_host	192.168.56.103:49166

Dollar.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All