popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

FineC0de.exe

Downloader UPX Socket ScreenShot Http API AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 11, 2023, 10:51 p.m. June 11, 2023, 11:33 p.m.
Size 4.0MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 d86704134f65f0ebe87032f76864db5a
SHA256 9e57ccd47600e2e5483b7464549bad124f2f529f09ad29a570f4e583a3355968
CRC32 54D01173
ssdeep 98304:XJs06Eg5LkheKEdyvea5ZUt9WnZQ+1yzmp8PN:XJq5cdQXCYSpS
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
5.42.64.41 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49168 -> 5.42.64.41:1337 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 5.42.64.41:1337 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49171 -> 5.42.64.41:1337 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 5.42.64.41:1337 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49168 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49171 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.103:49172 -> 5.42.64.41:1337 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 5.42.64.41:1337 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49172 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.103:49169 -> 5.42.64.41:1337 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 5.42.64.41:1337 -> 192.168.56.103:49169 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.103:49170 -> 5.42.64.41:1337 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 5.42.64.41:1337 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49170 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 192.168.56.103:49173 -> 5.42.64.41:1337 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 5.42.64.41:1337 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49173 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49168 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:1337 -> 192.168.56.103:49168 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49168 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49172 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:1337 -> 192.168.56.103:49172 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49172 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49173 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:1337 -> 192.168.56.103:49173 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49173 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49169 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:1337 -> 192.168.56.103:49169 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49169 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49170 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:1337 -> 192.168.56.103:49170 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49170 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49171 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:1337 -> 192.168.56.103:49171 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 5.42.64.41:1337 -> 192.168.56.103:49171 2022053 ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2 A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00980000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0099f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00990000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00981000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1952
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00982000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nss3.dll
file C:\Users\test22\AppData\Local\Temp\mozglue.dll
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\softokn3.dll
file C:\Users\test22\AppData\Local\Temp\freebl3.dll
file C:\Users\test22\AppData\Local\Temp\libcrypto.dll
Time & API Arguments Status Return Repeated

recv

 buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 11 Jun 2023 14:32:16 GMT Content-Type: application/octet-stream Content-Length: 685472 Connection: keep-alive vary: Origin access-control-allow-credentials: true access-control-expose-headers: Content-Type, Authorization accept-ranges: bytes cache-control: public, max-age=0 last-modified: Fri, 27 Jan 2023 19:52:42 GMT etag: W/"a75a0-185f4ca1310" MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL.%Ôcà"! 6 à Ç @A, Sk, ´  xL  )° X$d& 0 X. 8.text¿ `.rdata<0@@.data<F@  @À.00cfg  @@.rsrcx  " @@.relocX$° && @B
received: 1024
socket: 696
1 1024 0

recv

 buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 11 Jun 2023 14:32:17 GMT Content-Type: application/octet-stream Content-Length: 2519552 Connection: keep-alive vary: Origin access-control-allow-credentials: true access-control-expose-headers: Content-Type, Authorization accept-ranges: bytes cache-control: public, max-age=0 last-modified: Sat, 09 Jul 2022 00:05:20 GMT etag: W/"267200-181e0466a00" MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $‡õ2qÔ\"Ô\"Ô\"ÊìÏ"ה\"Âù]#Á”\"ÂùY#Ȕ\"ÂùX#ɔ\"Âù_#ɔ\"˜ü]#Ȕ\"Ô]"X”\"Ô\"Ք\"ùX#¶–\"ù\#”\"ù£"”\"ù^#”\"RichÔ\"PELwç]à! Dn H`ð&@Ð÷"„fŒÅ%Tð%|&ÈÏÐÛ"8Ü"@À%Œ.text£BD `.rdataTþ` H@@.dataØY
received: 1024
socket: 780
1 1024 0

recv

 buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 11 Jun 2023 14:32:17 GMT Content-Type: application/octet-stream Content-Length: 599456 Connection: keep-alive vary: Origin access-control-allow-credentials: true access-control-expose-headers: Content-Type, Authorization accept-ranges: bytes cache-control: public, max-age=0 last-modified: Fri, 27 Jan 2023 19:52:42 GMT etag: W/"925a0-185f4ca1310" MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELò$Ôcà"! hª` nœ @AÅ4[Ə, °ü ) ”BL' Êh  à”ì¨/.textᏐ `.rdataô ”@@.datahÀ¦@À.00cfgàª@@.tlsð¬@À.rsrc° ®@@.relo
received: 1024
socket: 788
1 1024 0

recv

 buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 11 Jun 2023 14:32:18 GMT Content-Type: application/octet-stream Content-Length: 2044832 Connection: keep-alive vary: Origin access-control-allow-credentials: true access-control-expose-headers: Content-Type, Authorization accept-ranges: bytes cache-control: public, max-age=0 last-modified: Fri, 27 Jan 2023 19:52:42 GMT etag: W/"1f33a0-185f4ca1310" MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL %Ôcà"! Ú,p’páä@A &úšÄ@Px  )`ìtð 0ÊT<&@.textyÙÚ `.rdataôîððÞ@@.dataDRà.Î@À.00cfg@ü@@.rsrcxPþ@@.relocì`@B
received: 1024
socket: 696
1 1024 0

recv

 buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 11 Jun 2023 14:32:19 GMT Content-Type: application/octet-stream Content-Length: 256416 Connection: keep-alive vary: Origin access-control-allow-credentials: true access-control-expose-headers: Content-Type, Authorization accept-ranges: bytes cache-control: public, max-age=0 last-modified: Fri, 27 Jan 2023 19:52:42 GMT etag: W/"3e9a0-185f4ca1310" MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL-%Ôcà"! Ìð0΁*@ADvS—wð°€À )À°58qà {Œ.textÊÌ `.rdataÔ«à¬Ð@@.data˜ |@À.00cfg „@@.rsrc€°†@@.reloc°5À6Š@B
received: 1024
socket: 780
1 1024 0

recv

 buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 11 Jun 2023 14:32:19 GMT Content-Type: application/octet-stream Content-Length: 1105974 Connection: keep-alive vary: Origin access-control-allow-credentials: true access-control-expose-headers: Content-Type, Authorization accept-ranges: bytes cache-control: public, max-age=0 last-modified: Thu, 07 Jul 2022 00:48:04 GMT etag: W/"10e036-181d620d1a0" MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÇ(·bŽ¿à! "  @ àa07 Ð ˆ* Ð 0 ¨@ (<   Ð.textT! " `P`.data|'@ (( @`À.rdatapDp FP @`@.bss(À €`À.edataˆ*Ð ,– @0@.idataÐ Â
received: 1024
socket: 784
1 1024 0
section {u'size_of_data': u'0x003ffa00', u'virtual_address': u'0x00002000', u'entropy': 7.999315816991094, u'name': u'.text', u'virtual_size': u'0x003ff9f3'} entropy 7.99931581699 description A section with a high entropy has been found
entropy 0.995502066618 description Overall entropy of this PE file is high
description Communications over RAW Socket rule Network_TCP_Socket
description PWS Memory rule Generic_PWS_Memory_Zero
description Match Windows Http API call rule Str_Win32_Http_API
description File Downloader rule Network_Downloader
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Take ScreenShot rule ScreenShot
host 5.42.64.41
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ@@´LÍ!¸rÁ ä6 e·6 e·6 e·åÒf¶8 e·åÒ`¶” e·åÒa¶  e·åÒd¶5 e·6 d·  e·‰Üa¶' e·‰Üf¶  e·‰Ü`¶d e·ïÝl¶# e·ïÝg¶7 e·Rich6 e·PEL@‚dà #&Nv@@°@ '(€˜%Ð@@”.textF$& `.rdata<ð@ò*@@.data05@@À.reloc˜%€&,@B
base_address: 0x004c0000
process_identifier: 2444
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: L
base_address: 0x7efde008
process_identifier: 2444
process_handle: 0x00000264
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ@@´LÍ!¸rÁ ä6 e·6 e·6 e·åÒf¶8 e·åÒ`¶” e·åÒa¶  e·åÒd¶5 e·6 d·  e·‰Üa¶' e·‰Üf¶  e·‰Ü`¶d e·ïÝl¶# e·ïÝg¶7 e·Rich6 e·PEL@‚dà #&Nv@@°@ '(€˜%Ð@@”.textF$& `.rdata<ð@ò*@@.data05@@À.reloc˜%€&,@B
base_address: 0x004c0000
process_identifier: 2444
process_handle: 0x00000264
1 1 0
Process injection Process 1952 called NtSetContextThread to modify thread in remote process 2444
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4290048
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2444
1 0 0
Process injection Process 1952 resumed a thread in remote process 2444
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2444
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1952
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 1952
1 0 0

NtResumeThread

 thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 1952
1 0 0

CreateProcessInternalW

 thread_identifier: 2448
thread_handle: 0x00000260
process_identifier: 2444
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\FineC0de.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\FineC0de.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\FineC0de.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000264
1 1 0

NtGetContextThread

 thread_handle: 0x00000260
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0

WriteProcessMemory

 buffer: MZÿÿ@@´LÍ!¸rÁ ä6 e·6 e·6 e·åÒf¶8 e·åÒ`¶” e·åÒa¶  e·åÒd¶5 e·6 d·  e·‰Üa¶' e·‰Üf¶  e·‰Ü`¶d e·ïÝl¶# e·ïÝg¶7 e·Rich6 e·PEL@‚dà #&Nv@@°@ '(€˜%Ð@@”.textF$& `.rdata<ð@ò*@@.data05@@À.reloc˜%€&,@B
base_address: 0x004c0000
process_identifier: 2444
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004c1000
process_identifier: 2444
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004f4000
process_identifier: 2444
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00504000
process_identifier: 2444
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00508000
process_identifier: 2444
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: L
base_address: 0x7efde008
process_identifier: 2444
process_handle: 0x00000264
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4290048
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2444
1 0 0

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2444
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Inject.1b!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.67448395
ALYac Trojan.GenericKD.67448395
Cylance unsafe
Sangfor Suspicious.Win32.Save.a
Alibaba Trojan:MSIL/Kryptik.b74a1f55
K7GW Trojan ( 0059df7d1 )
CrowdStrike win/malicious_confidence_100% (W)
Cyren W32/MSIL_Kryptik.JLT.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.AHUA
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.Inject.gen
BitDefender Trojan.GenericKD.67448395
Avast Win32:RATX-gen [Trj]
Emsisoft Trojan.GenericKD.67448395 (B)
F-Secure Trojan.TR/Kryptik.njokw
VIPRE Trojan.GenericKD.67448395
TrendMicro Trojan.MSIL.INJECT.USPAXFA23
McAfee-GW-Edition BehavesLike.Win32.Generic.rc
Trapmine malicious.high.ml.score
FireEye Generic.mg.d86704134f65f0eb
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
GData Trojan.GenericKD.67448395
Webroot W32.Trojan.GenKD
Avira TR/Kryptik.njokw
MAX malware (ai score=89)
Antiy-AVL Trojan/MSIL.Kryptik
Arcabit Trojan.Generic.D4052E4B
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5439563
Acronis suspicious
McAfee Artemis!D86704134F65
Malwarebytes Trojan.Crypt
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.MSIL.INJECT.USPAXFA23
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:NYslgDoWwU66V3isAg/4TQ)
Ikarus Trojan.MSIL.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.ADWG!tr
BitDefenderTheta Gen:NN.ZemsilF.36250.@p0@amBFVpcG
AVG Win32:RATX-gen [Trj]
Cybereason malicious.83b8a3
DeepInstinct MALICIOUS