popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ohoyeczx.exe

stealer email Generic Malware UPX Downloader Antivirus HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Http API persistence FTP Socket Escalate priviledges DNS Code injection PWS Sniff Audio Steal credential AntiDebug PE64 PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 18, 2023, 6:21 p.m. July 18, 2023, 6:30 p.m.
Size 19.5KB
Type PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
MD5 f7d1117ace1e63a2a3cf9d45cb94b9b5
SHA256 4a84d6c38aa517a0d9de7061f11ebffb73f6580eabae4d7e3d6d888d3ac7a611
CRC32 25F3E142
ssdeep 384:Hm6GfkbfZO01twZeTSlxTSSifV/1Sczw/FZqcqTDV08KCTL6sy0iHog23t:HNq701+Ze2l0d/zzwv5qvVvlL1ynHo39
Yara
  • UPX_Zero - UPX packed file
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
kyliansuperm92139124.shop
A 172.67.183.88
A 104.21.18.206
172.67.183.88
IP Address Status Action
164.124.101.2 Active Moloch
172.67.183.88 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49163 -> 172.67.183.88:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 172.67.183.88:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49163
172.67.183.88:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=kyliansuperm92139124.shop 5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35
TLSv1
192.168.56.101:49171
172.67.183.88:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=kyliansuperm92139124.shop 5d:12:dd:20:a0:65:30:8a:69:86:14:a3:f1:fa:b8:aa:9e:5d:b8:35

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "svchost" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: The batch file cannot be found.
console_handle: 0x000000000000000b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000001040c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8f2c60
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8f2c60
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8f2c60
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
exception.instruction: add byte ptr [eax], al
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x1b18a
registers.esp: 3603572
registers.edi: 0
registers.eax: 1968976824
registers.ebp: 3603648
registers.edx: 4218408
registers.ebx: 4294828032
registers.esi: 0
registers.ecx: 0
1 0 0
suspicious_features GET method with no useragent header suspicious_request GET https://kyliansuperm92139124.shop/customer/1236
request GET https://kyliansuperm92139124.shop/customer/1236
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000880000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a31000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef40cb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000021a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a34000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a34000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a34000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a34000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9428a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9433c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94366000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9429c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9428c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9429a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9428b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94282000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9429b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94401000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94402000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94403000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94404000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\svchost.exe
file C:\Users\test22\AppData\Local\Temp\tmpBBB9.tmp.bat
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"'
cmdline "C:\Users\test22\AppData\Roaming\svchost.exe"
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\svchost.exe" -Force
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
cmdline powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\svchost.exe" -Force
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
filepath: cmd
1 1 0

CreateProcessInternalW

 thread_identifier: 2068
thread_handle: 0x0000000000000664
process_identifier: 2064
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\tmpBBB9.tmp.bat"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000660
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\svchost.exe" -Force
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Install itself for autorun at Windows startup rule Persistence
description email clients info stealer rule infoStealer_emailClients_Zero
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communications over P2P network rule Network_P2P_Win
description Communication using DGA rule Network_DGA
description Steal credential rule local_credential_Steal
description Match Windows Http API call rule Str_Win32_Http_API
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Take ScreenShot rule ScreenShot
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2268
thread_handle: 0x000000000000006c
process_identifier: 2264
current_directory:
filepath: C:\Users\test22\AppData\Roaming\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\svchost.exe"
filepath_r: C:\Users\test22\AppData\Roaming\svchost.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000070
1 1 0
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1384
process_handle: 0x0000000000000754
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1384
process_handle: 0x0000000000000754
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2256
process_handle: 0x000000000000068c
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2256
process_handle: 0x000000000000068c
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2596
process_handle: 0x0000000000000738
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2596
process_handle: 0x0000000000000738
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2600
process_handle: 0x0000000000000740
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2600
process_handle: 0x0000000000000740
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2360
process_handle: 0x0000000000000784
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2360
process_handle: 0x0000000000000784
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2492
process_handle: 0x0000000000000770
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2492
process_handle: 0x0000000000000770
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1996
process_handle: 0x00000000000003c8
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1996
process_handle: 0x00000000000003c8
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2712
process_handle: 0x0000000000000790
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2712
process_handle: 0x0000000000000790
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 828
process_handle: 0x0000000000000798
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 828
process_handle: 0x0000000000000798
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 536
process_handle: 0x00000000000007a0
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 536
process_handle: 0x00000000000007a0
1 0 0
cmdline schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"'
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
cmdline C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
cmdline C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
buffer Buffer with sha1: fc3259ab9cdb84d032b30337a853761a19805657
buffer Buffer with sha1: d644211fca6d53f5d9b5e541145c618f31e1a924
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1252
region_size: 1433600
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000079c
1 0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\svchost reg_value "C:\Users\test22\AppData\Roaming\svchost.exe"
cmdline schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"'
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
Time & API Arguments Status Return Repeated

CreateServiceA

 service_start_name:
start_type: 3
password:
display_name: Zemana
filepath: C:\Zemana.sys
service_name: Zemana
filepath_r: C:\Zemana.sys
desired_access: 983551
service_handle: 0x000000001bf197b0
error_control: 0
service_type: 1
service_manager_handle: 0x000000001bf193c0
1 468817840 0
file C:\Users\test22\AppData\Roaming\svchost.exe
Process injection Process 2064 resumed a thread in remote process 2264
Process injection Process 2264 resumed a thread in remote process 1252
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000006c
suspend_count: 0
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x00000000000007a0
suspend_count: 1
process_identifier: 1252
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Windows\System32\drivers\VBoxMouse.sys
registry HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
file C:\Windows\System32\drivers\vmmouse.sys
file C:\Windows\System32\drivers\vmhgfs.sys
registry HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x00000000001dc330
function_name: wine_get_unix_file_name
module: KERNEL32
module_address: 0x0000000076c10000
-1073741511 0

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000000000030c7b0
function_name: wine_get_unix_file_name
module: KERNEL32
module_address: 0x0000000076c10000
-1073741511 0
description attempts to disable user access control registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2544
1 0 0

NtResumeThread

 thread_handle: 0x000000000000013c
suspend_count: 1
process_identifier: 2544
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000184
suspend_count: 1
process_identifier: 2544
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000368
suspend_count: 1
process_identifier: 2544
1 0 0

NtResumeThread

 thread_handle: 0x00000000000005b8
suspend_count: 1
process_identifier: 2544
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d0
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d0
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d0
suspend_count: 1
process_identifier: 2544
1 0 0

NtResumeThread

 thread_handle: 0x00000000000005c0
suspend_count: 1
process_identifier: 2544
1 0 0

NtResumeThread

 thread_handle: 0x00000000000005fc
suspend_count: 1
process_identifier: 2544
1 0 0

CreateProcessInternalW

 thread_identifier: 2056
thread_handle: 0x0000000000000760
process_identifier: 812
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000768
1 1 0

CreateProcessInternalW

 thread_identifier: 2068
thread_handle: 0x0000000000000664
process_identifier: 2064
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\tmpBBB9.tmp.bat"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000660
1 1 0

CreateProcessInternalW

 thread_identifier: 2124
thread_handle: 0x0000000000000060
process_identifier: 2120
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\test22\AppData\Roaming\svchost.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

CreateProcessInternalW

 thread_identifier: 2236
thread_handle: 0x0000000000000068
process_identifier: 2224
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\timeout.exe
track: 1
command_line: timeout 3
filepath_r: C:\Windows\system32\timeout.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000070
1 1 0

CreateProcessInternalW

 thread_identifier: 2268
thread_handle: 0x000000000000006c
process_identifier: 2264
current_directory:
filepath: C:\Users\test22\AppData\Roaming\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\svchost.exe"
filepath_r: C:\Users\test22\AppData\Roaming\svchost.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000070
1 1 0

NtResumeThread

 thread_handle: 0x000000000000006c
suspend_count: 0
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d0
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000140
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000180
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x000000000000036c
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x00000000000005d0
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d4
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x00000000000005dc
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000618
suspend_count: 1
process_identifier: 2264
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000680
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d4
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d4
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d4
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000680
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000680
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000680
suspend_count: 1
process_identifier: 2264
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000680
suspend_count: 1
process_identifier: 2264
1 0 0

CreateProcessInternalW

 thread_identifier: 3008
thread_handle: 0x000000000000077c
process_identifier: 3024
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\svchost.exe" -Force
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000784
1 1 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000680
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000680
suspend_count: 1
process_identifier: 2264
1 0 0
Lionic Trojan.Win32.Fsysna.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.68222557
FireEye Trojan.GenericKD.68222557
McAfee Artemis!F7D1117ACE1E
Malwarebytes Generic.Malware/Suspicious
Sangfor Trojan.Msil.Kryptik.Vu4x
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D410FE5D
VirIT Trojan.Win64.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik_AGen.BBP
Kaspersky HEUR:Trojan.MSIL.Fsysna.gen
BitDefender Trojan.GenericKD.68222557
Avast Win64:MalwareX-gen [Trj]
Sophos Mal/Generic-S
McAfee-GW-Edition Artemis!Trojan
Emsisoft Trojan.GenericKD.68222557 (B)
Ikarus Win32.Outbreak
Webroot W32.Trojan.Gen
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Trojan.MSIL.Fsysna.gen
GData Trojan.GenericKD.68222557
Google Detected
MAX malware (ai score=81)
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H0DGH23
Rising Malware.Obfus/MSIL@AI.85 (RDM.MSIL2:eMD2vVQ4V+PBZgmCI/3gHg)
SentinelOne Static AI - Suspicious PE
Fortinet MSIL/Kryptik_AGen.BBP!tr
AVG Win64:MalwareX-gen [Trj]
DeepInstinct MALICIOUS