Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 14, 2023, 9:41 a.m.	July 14, 2023, 9:45 a.m.

Size	435.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`8389ef289fda3d0c64e8b482f820b628`
SHA256	`42ef434d4f2fbb1d7dcc088b49c7fd18b15a5cc6871d3b03126071f2981de33f`
CRC32	`602C3F3D`
ssdeep	`12288:vYkufGTvuYov3DbKsR/ovffKW9iDU5QZcd:vYkuYorxR/oHW2d`
Yara	UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

igccu.exe "C:\Users\test22\AppData\Local\Temp\igccu.exe"
1020
- igccu.exe "C:\Users\test22\AppData\Local\Temp\igccu.exe"
  2132

Name	Response	Post-Analysis Lookup
us2.smtp.mailhostbox.com	A 208.91.199.224 A 208.91.198.143 A 208.91.199.225 A 208.91.199.223	208.91.199.224
showip.net	A 162.55.60.2	162.55.60.2

IP Address	Status	Action
108.170.55.202	Active	Moloch
162.55.60.2	Active	Moloch
164.124.101.2	Active	Moloch
208.91.199.224	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 162.55.60.2:80	2008987	ET POLICY IP Check Domain (showip in HTTP Host)	Attempted Information Leak
TCP 208.91.199.224:587 -> 192.168.56.103:49169	2260002	SURICATA Applayer Detect protocol only one direction	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 14, 2023, 9:41 a.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 14, 2023, 9:41 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (50 out of 352 events)

Time & API	Arguments	Status
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1635032 registers.edi: 5390624 registers.eax: 1635032 registers.ebp: 1635112 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 5390624 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 5390624 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 5390624 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633992 registers.edi: 5390624 registers.eax: 1633992 registers.ebp: 1634072 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 5390624 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 5390624 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633308 registers.edi: 5390624 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 5390624 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 5390624 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633308 registers.edi: 5390624 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 5390624 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634284 registers.edi: 1634560 registers.eax: 1634284 registers.ebp: 1634364 registers.edx: 0 registers.ebx: 5390624 registers.esi: 1634560 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633308 registers.edi: 5390624 registers.eax: 1633308 registers.ebp: 1633388 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1633916 registers.edi: 5390624 registers.eax: 1633916 registers.ebp: 1633996 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1635056 registers.edi: 5390624 registers.eax: 1635056 registers.ebp: 1635136 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1635056 registers.edi: 5390624 registers.eax: 1635056 registers.ebp: 1635136 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 5390624 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 5390624 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 5390624 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 5390624 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 5390624 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634260 registers.edi: 5390624 registers.eax: 1634260 registers.ebp: 1634340 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1
__exception__ July 14, 2023, 9:41 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1634844 registers.edi: 5390624 registers.eax: 1634844 registers.ebp: 1634924 registers.edx: 0 registers.ebx: 5390624 registers.esi: 5390624 registers.ecx: 2	1

Performs some HTTP requests (1 event)

request

GET http://showip.net/

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 14, 2023, 9:41 a.m.	process_identifier: 1020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741df000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 14, 2023, 9:41 a.m.	process_identifier: 1020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d30000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fireplough.exe
file	C:\Users\Public\Libraries\vbsqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\nssC996.tmp\ldtydipfry.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fireplough.exe
file	C:\Users\test22\AppData\Local\Temp\nssC996.tmp\ldtydipfry.dll

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 14, 2023, 9:41 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x004b0000 process_handle: 0xffffffff	1	0	0

Makes SMTP requests, possibly sending spam (1 event)

sender

[u'elibe@haewrsan.com']

server

208.91.199.224

user

elibe@haewrsan.com

receiver

[u'resultlog70@gmail.com']

password

jCXzqcP1 daniel 3116

Communicates with host for which no DNS query was performed (1 event)

host

108.170.55.202

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\abadia

reg_value

C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fireplough.exe

Harvests credentials from local email clients (5 events)

file	C:\Users\test22\AppData\Local\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Store Root
registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Account Manager\Shared

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1020 called NtSetContextThread to modify thread in remote process 2132
NtSetContextThread July 14, 2023, 9:41 a.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4209688 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000230 process_identifier: 2132	1	0	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.tshg
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Garf.Gen.10
McAfee	Artemis!8389EF289FDA
VIPRE	Trojan.Garf.Gen.10
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.Garf.Gen.10
Arcabit	Trojan.Garf.Gen.10 [many]
Cyren	W32/Injector.BOI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ETCS
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win32:TrojanX-gen [Trj]
Emsisoft	Trojan.Garf.Gen.10 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.8389ef289fda3d0c
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.FormBook
Webroot	W32.Trojan.Gen
Google	Detected
MAX	malware (ai score=82)
Gridinsoft	Trojan.Win32.Gen.bot
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Win32.Trojan.Agent.U8O2BU
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R587806
Acronis	suspicious
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H01GD23
Rising	Trojan.Strab!8.12D03 (TFE:5:Hw8T7cRxNYL)
SentinelOne	Static AI - Suspicious PE
Fortinet	NSIS/Agent.DCAC!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

igccu.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All