Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 14, 2023, 7:29 a.m.	July 14, 2023, 7:39 a.m.

Size	227.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`fcb679b0de5f4f8ac6758087df0eea4b`
SHA256	`b7c02d80a783e31957b0bcecf56c7fbec20dc513d021e7c814df913fe01fd491`
CRC32	`DA08271A`
ssdeep	`6144:SRW/xODAdhADhsr5fd7ypY3uViNewxWsr7r4wP4zhkXSQB5DOljU+pE8DaOl5yLD:SRW/xODAdhADhsr5fd7ypY3uViNewxWw`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) PE_Header_Zero - PE File Signature

Ads.exe "C:\Users\test22\AppData\Local\Temp\Ads.exe"
1540
- CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2620

Name	Response	Post-Analysis Lookup
kyliansuperm92139124.shop	A 172.67.183.88 A 104.21.18.206	172.67.183.88

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.183.88	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 172.67.183.88:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49162 172.67.183.88:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=kyliansuperm92139124.shop	5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 14, 2023, 7:29 a.m.			0	0
IsDebuggerPresent July 14, 2023, 7:29 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey July 14, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004362d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000435f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000435f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bb21090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bb21090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 14, 2023, 7:29 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bb21090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 14, 2023, 7:29 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://kyliansuperm92139124.shop/customer/1115

Performs some HTTP requests (1 event)

request

GET https://kyliansuperm92139124.shop/customer/1115

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 14, 2023, 7:28 a.m.	process_identifier: 1540 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:28 a.m.	process_identifier: 1540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002440000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 1540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 14, 2023, 7:29 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 14, 2023, 7:29 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.microsoft.com/exporting

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 281fbc53c60ed775b94437531539df31bea927e6
buffer	Buffer with sha1: 3b462f4a1ba83f69a6ce2b5cca8b57d3518588f9

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 2620 region_size: 253952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000005a8	1	0	0

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA July 14, 2023, 7:29 a.m.	service_start_name: start_type: 3 password: display_name: Zemana filepath: C:\Zemana.sys service_name: Zemana filepath_r: C:\Zemana.sys desired_access: 983551 service_handle: 0x000000001bb917f0 error_control: 0 service_type: 1 service_manager_handle: 0x000000001bb91430	1	465115120	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1540 resumed a thread in remote process 2620
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000248 suspend_count: 1 process_identifier: 2620	1	0	0

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.68153009
McAfee	Artemis!FCB679B0DE5F
Alibaba	Trojan:MSIL/Kryptik_AGen.0618089d
VirIT	Trojan.Win64.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik_AGen.BAV
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.68153009
Avast	Win64:PWSX-gen [Trj]
Emsisoft	Trojan.GenericKD.68153009 (B)
F-Secure	Trojan.TR/Redcap.ljlbs
DrWeb	Trojan.InjectNET.59
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.GenericKD.68153009
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.ljlbs
Microsoft	Trojan:Win32/Formbook!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.68153009
Google	Detected
MAX	malware (ai score=84)
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R014H0DGD23
Ikarus	Trojan-Downloader.MSIL.Agent
AVG	Win64:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Executed a process and injected code into it, probably while unpacking (50 out of 66 events)

Time & API	Arguments	Status	Return
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000358 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000224 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtSetContextThread July 14, 2023, 7:29 a.m.	registers.r14: 2150704 registers.r15: 360396934 registers.rcx: 89 registers.rsi: 221 registers.r10: 221 registers.rbx: 53 registers.rsp: 2148384 registers.r11: 8789984936200 registers.r8: 40923376 registers.r9: 2908216347 registers.rip: 8791587454624 registers.rdx: 43 registers.r12: 0 registers.rbp: 221 registers.rdi: 40911328 registers.rax: 2 registers.r13: 4270336 thread_handle: 0x00000000000000c8 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
CreateProcessInternalW July 14, 2023, 7:29 a.m.	thread_identifier: 2624 thread_handle: 0x0000000000000248 process_identifier: 2620 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000005a8	1	1
NtAllocateVirtualMemory July 14, 2023, 7:29 a.m.	process_identifier: 2620 region_size: 253952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000005a8	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000248 suspend_count: 1 process_identifier: 2620	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000224	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000224	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000224 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x0000000000000384 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8	1	0
NtSetContextThread July 14, 2023, 7:29 a.m.	registers.r14: 2150704 registers.r15: 360396934 registers.rcx: 919 registers.rsi: 138 registers.r10: 511101108225 registers.rbx: 137 registers.rsp: 2148112 registers.r11: 8791563775128 registers.r8: 40859616 registers.r9: 41000736 registers.rip: 8791587454624 registers.rdx: 138 registers.r12: 2148544 registers.rbp: 138 registers.rdi: 40842016 registers.rax: 0 registers.r13: 4270336 thread_handle: 0x00000000000000c8 process_identifier: 1540	1	0
NtResumeThread July 14, 2023, 7:29 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:30 a.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread July 14, 2023, 7:30 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread July 14, 2023, 7:30 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:30 a.m.	thread_handle: 0x0000000000000384	1	0
NtGetContextThread July 14, 2023, 7:30 a.m.	thread_handle: 0x0000000000000384	1	0
NtResumeThread July 14, 2023, 7:30 a.m.	thread_handle: 0x0000000000000384 suspend_count: 1 process_identifier: 1540	1	0
NtGetContextThread July 14, 2023, 7:30 a.m.	thread_handle: 0x0000000000000384	1	0

Ads.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All