Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 31, 2023, 4:48 p.m.	July 31, 2023, 4:51 p.m.

Size	2.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6258ec13a6d93e6ca60755540abebde6`
SHA256	`3a64dce714d28968b2691168a78e037f66d2b16b57660f96d77415bba4724b0e`
CRC32	`A06390EF`
ssdeep	`49152:TvyOljHoXElZVu6PRd9K37Bnst8sww+OY8qpLBxUeYOasDhG:TvyOxHF9K37hstKwb+hAgDo`
PDB Path	skyrate8472menu_app.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

3a64dce714d28968b2691168a78e037f66d2b16b57660f96d77415bba4724b0e.exe "C:\Users\test22\AppData\Local\Temp\3a64dce714d28968b2691168a78e037f66d2b16b57660f96d77415bba4724b0e.exe"
2576
- MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2728

Name	Response	Post-Analysis Lookup
t.me	A 149.154.167.99	149.154.167.99
steamcommunity.com	A 23.41.77.6	184.87.111.197

IP Address	Status	Action
149.154.167.99	Active	Moloch
164.124.101.2	Active	Moloch
23.41.77.6	Active	Moloch
78.47.122.222	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 149.154.167.99:443	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	Misc activity
TCP 192.168.56.101:49165 -> 149.154.167.99:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49165 -> 149.154.167.99:443	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	Misc activity
TCP 192.168.56.101:49166 -> 149.154.167.99:443	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	Misc activity
TCP 192.168.56.101:49166 -> 149.154.167.99:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49166 -> 149.154.167.99:443	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	Misc activity
TCP 192.168.56.101:49170 -> 78.47.122.222:80	2027262	ET INFO Dotted Quad Host ZIP Request	Potentially Bad Traffic
TCP 149.154.167.99:443 -> 192.168.56.101:49167	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 23.41.77.6:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49165 -> 149.154.167.99:443	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	Misc activity
TCP 192.168.56.101:49166 -> 149.154.167.99:443	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49169 23.41.77.6:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA	unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com	b1:30:5e:4c:ee:14:70:87:a7:d7:1c:77:07:b5:3c:2c:99:13:aa:c5

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameA July 31, 2023, 4:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 31, 2023, 4:48 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 31, 2023, 4:48 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 31, 2023, 4:48 p.m.			0	0
IsDebuggerPresent July 31, 2023, 4:48 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

skyrate8472menu_app.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 31, 2023, 4:48 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

GIF

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://78.47.122.222/49e93e6e2313dda7ead0e57f3f0fc459
suspicious_features	Connection to IP address				suspicious_request	GET http://78.47.122.222/pack.zip

Performs some HTTP requests (3 events)

request	GET http://78.47.122.222/49e93e6e2313dda7ead0e57f3f0fc459
request	GET http://78.47.122.222/pack.zip
request	GET https://steamcommunity.com/profiles/76561199529242058

Allocates read-write-execute memory (usually to unpack itself) (32 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00591000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00594000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0119c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0119d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c14000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0119e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2728 region_size: 995328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x61e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (6 events)

file	C:\ProgramData\vcruntime140.dll
file	C:\ProgramData\msvcp140.dll
file	C:\ProgramData\nss3.dll
file	C:\ProgramData\freebl3.dll
file	C:\ProgramData\mozglue.dll
file	C:\ProgramData\softokn3.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00264000', u'virtual_address': u'0x00002000', u'entropy': 7.129348688424999, u'name': u'.text', u'virtual_size': u'0x00263ec4'}

entropy

7.12934868842

description

A section with a high entropy has been found

entropy

0.953085458439

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 31, 2023, 4:48 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (2 events)

url	https://t.me/dastantim
url	https://steamcommunity.com/profiles/76561199529242058

Yara rule detected in process memory (12 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Win32 PWS Loki	rule	Win32_PWS_Loki_m_Zero
description	Virtual currency	rule	Virtual_currency_Zero

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 9b8782093d75ebe98b4a00b732edba13fc952746
buffer	Buffer with sha1: 8a7a16e1bb29ef6a29ec7e71bdc776d6bdfda170

Communicates with host for which no DNS query was performed (1 event)

host

78.47.122.222

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2728 region_size: 880640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $b-B&L,A&L,A&L,Aµ´A'L,AI:²A:L,AI:AºL,A/4¯A#L,A/4¿A+L,A&L-AWL,AI:AoL,AI:±A'L,ARich&L,APEL©ÔÄdà Æ%r@p @lP (G8f@.textë~ `.rdatað@@.datadR°@À.relocÎ\ ^´@B base_address: 0x00400000 process_identifier: 2728 process_handle: 0x00000240	1	1	0
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2728 process_handle: 0x00000240	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $b-B&L,A&L,A&L,Aµ´A'L,AI:²A:L,AI:AºL,A/4¯A#L,A/4¿A+L,A&L-AWL,AI:AoL,AI:±A'L,ARich&L,APEL©ÔÄdà Æ%r@p @lP (G8f@.textë~ `.rdatað@@.datadR°@À.relocÎ\ ^´@B base_address: 0x00400000 process_identifier: 2728 process_handle: 0x00000240	1	1	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Elastic	malicious (high confidence)
Cylance	unsafe
Sangfor	Infostealer.Msil.Kryptik.V0xe
BitDefenderTheta	Gen:NN.ZemsilF.36318.Ho2@a4QUrgni
Cyren	W32/MSIL_Agent.FZK.gen!Eldorado
ESET-NOD32	a variant of MSIL/Kryptik.AJDT
Kaspersky	UDS:Trojan-PSW.MSIL.Stealerc.gen
Avast	PWSX-gen [Trj]
FireEye	Generic.mg.6258ec13a6d93e6c
ZoneAlarm	UDS:Trojan-PSW.MSIL.Stealerc.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
Rising	Trojan.Kryptik!8.8 (CLOUD)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.AJDT!tr
AVG	PWSX-gen [Trj]
DeepInstinct	MALICIOUS

Network activity contains more than one unique useragent (2 events)

process	MSBuild.exe				useragent	Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
process	MSBuild.exe				useragent	Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2576 called NtSetContextThread to modify thread in remote process 2728
NtSetContextThread July 31, 2023, 4:48 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4420133 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2728	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2576 resumed a thread in remote process 2728
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2728	1	0	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2576	1	0
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2576	1	0
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2576	1	0
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2576	1	0
NtGetContextThread July 31, 2023, 4:48 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread July 31, 2023, 4:48 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2576	1	0
CreateProcessInternalW July 31, 2023, 4:48 p.m.	thread_identifier: 2732 thread_handle: 0x0000023c process_identifier: 2728 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread July 31, 2023, 4:48 p.m.	thread_handle: 0x0000023c	1	0
NtAllocateVirtualMemory July 31, 2023, 4:48 p.m.	process_identifier: 2728 region_size: 880640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $b-B&L,A&L,A&L,Aµ´A'L,AI:²A:L,AI:AºL,A/4¯A#L,A/4¿A+L,A&L-AWL,AI:AoL,AI:±A'L,ARich&L,APEL©ÔÄdà Æ%r@p @lP (G8f@.textë~ `.rdatað@@.datadR°@À.relocÎ\ ^´@B base_address: 0x00400000 process_identifier: 2728 process_handle: 0x00000240	1	1
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: base_address: 0x00401000 process_identifier: 2728 process_handle: 0x00000240	1	1
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: base_address: 0x00449000 process_identifier: 2728 process_handle: 0x00000240	1	1
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: base_address: 0x0045b000 process_identifier: 2728 process_handle: 0x00000240	1	1
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: base_address: 0x004d1000 process_identifier: 2728 process_handle: 0x00000240	1	1
WriteProcessMemory July 31, 2023, 4:48 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2728 process_handle: 0x00000240	1	1
NtSetContextThread July 31, 2023, 4:48 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4420133 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2728	1	0
NtResumeThread July 31, 2023, 4:48 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2728	1	0

3a64dce714d28968b2691168a78e037f66d2b16b57660f96d77415bba4724b0e

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All