popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

plugmanzx.exe

Backdoor Client SW User Data Stealer RemcosRAT info stealer browser .NET framework(MSIL) Chrome Downloader Google User Data ScreenShot Create Service KeyLogger Internet API Socket Escalate priviledges DNS PWS Sniff Audio AntiDebug .NET EXE PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 4, 2023, 8:56 a.m. Aug. 4, 2023, 9:19 a.m.
Size 851.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5ec330fe2550aa08c66a9ffc6c034306
SHA256 abe74320624508bf03e3a0c1024fbff5b4109751931182856d8e18ad784f010a
CRC32 E37B4356
ssdeep 24576:T/OZBSwCJgo8VWlCf1hLWrx0wVsfvLYv1GP:KIJgUEf2F0wsfs9GP
PDB Path ymzhAA.pdb
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
b6079658.sytes.net
A 109.206.243.174
109.206.243.174
geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
109.206.243.174 Active Moloch
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 109.206.243.174:6110 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2044233 ET INFO DYNAMIC_DNS Query to a *.sytes.net Domain Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49165
109.206.243.174:6110 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path ymzhAA.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain b6079658.sytes.net
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00550000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00580000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00600000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00562000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0134f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00afa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description plugmanzx.exe tried to sleep 278 seconds, actually delayed analysis time by 278 seconds
section {u'size_of_data': u'0x000d3200', u'virtual_address': u'0x00002000', u'entropy': 7.992049469925648, u'name': u'.text', u'virtual_size': u'0x000d31b4'} entropy 7.99204946993 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001800', u'virtual_address': u'0x000d6000', u'entropy': 7.073965745056115, u'name': u'.rsrc', u'virtual_size': u'0x0000171c'} entropy 7.07396574506 description A section with a high entropy has been found
entropy 0.999412455934 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Client_SW_User_Data_Stealer rule Client_SW_User_Data_Stealer
description Win Backdoor RemcosRAT rule Win_Backdoor_RemcosRAT
description Communications over RAW Socket rule Network_TCP_Socket
description browser info stealer rule infoStealer_browser_Zero
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications use DNS rule Network_DNS
description Take ScreenShot rule ScreenShot
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2504
process_handle: 0x00000260
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2504
process_handle: 0x00000260
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2504
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0
Process injection Process 912 manipulating memory of non-child process 2504
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2504
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $<‰ä%xèŠvxèŠvxèŠvÌt{vkèŠvÌtyvßèŠvÌtxvfèŠvqvyèŠvæHMvzèŠvÕ¶‰wbèŠvÕ¶wBèŠvÕ¶ŽwZèŠvqvaèŠvxè‹vBéŠvͶƒwèŠvͶuvyèŠvͶˆwyèŠvRichxèŠvPELÿìÀdà l D€@€HÞ€ÄJÐH;àÂ8tÃÃ@€ì.text…kl `.rdataüx€zp@@.data]ê@À.tls `ø@À.gfids0pú@@.rsrcÄJ€Lþ@@.relocH;Ð<J@B
base_address: 0x00400000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ¬ÅE°ÈEªÅE..€G\G\G\G\G\G\G\G\G\G„G`G`G`G`G`G`G`GˆGÿÿÿÿ°ÈE¨G¨G¨G¨G¨GˆG0ËE°ÌEøÚEèG€GCPSTPDT°GðGÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€Gþÿÿÿþÿÿÿu˜Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¶FEA$¶F½GA0¶FÜDA´†E.?AVtype_info@@´†E.?AVbad_alloc@std@@´†E.?AVbad_array_new_length@std@@´†E.?AVlogic_error@std@@´†E.?AVlength_error@std@@´†E.?AVout_of_range@std@@´†E.?AV_Facet_base@std@@´†E.?AV_Locimp@locale@std@@´†E.?AVfacet@locale@std@@´†E.?AU_Crt_new_delete@std@@´†E.?AVcodecvt_base@std@@´†E.?AUctype_base@std@@´†E.?AV?$ctype@D@std@@´†E.?AV?$codecvt@DDU_Mbstatet@@@std@@´†E.?AVbad_exception@std@@´†E.H´†E.?AVfailure@ios_base@std@@´†E.?AVruntime_error@std@@´†E.?AVsystem_error@std@@´†E.?AVbad_cast@std@@´†E.?AV_System_error@std@@´†E.?AVexception@std@@
base_address: 0x00470000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x00476000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: f5K5§>ñ9 :§>Y:§>iê§>í —µ–:}}P:nõ]õ‘R9R§>§>_‡²†:ß9î 5HW  ðz®}°ºˆ»áà3@œ†Ó#·•‡DË6;4]Le b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x00477000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2540
process_handle: 0x00000264
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $<‰ä%xèŠvxèŠvxèŠvÌt{vkèŠvÌtyvßèŠvÌtxvfèŠvqvyèŠvæHMvzèŠvÕ¶‰wbèŠvÕ¶wBèŠvÕ¶ŽwZèŠvqvaèŠvxè‹vBéŠvͶƒwèŠvͶuvyèŠvͶˆwyèŠvRichxèŠvPELÿìÀdà l D€@€HÞ€ÄJÐH;àÂ8tÃÃ@€ì.text…kl `.rdataüx€zp@@.data]ê@À.tls `ø@À.gfids0pú@@.rsrcÄJ€Lþ@@.relocH;Ð<J@B
base_address: 0x00400000
process_identifier: 2540
process_handle: 0x00000264
1 1 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a1cb
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 262593 0
Process injection Process 912 called NtSetContextThread to modify thread in remote process 2540
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4408333
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2540
1 0 0
Process injection Process 912 resumed a thread in remote process 2540
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2540
1 0 0
Malwarebytes MachineLearning/Anomalous.96%
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (D)
Symantec MSIL.Packed.32
Elastic malicious (high confidence)
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Avast FileRepMalware [Rat]
McAfee-GW-Edition BehavesLike.Win32.Generic.cc
Trapmine suspicious.low.ml.score
Microsoft Trojan:MSIL/LokiBot.RPX!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
McAfee Artemis!5EC330FE2550
Cylance unsafe
Rising Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:stxeWcXQ9jQZIMPJYJCk+Q)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.RATX!tr
AVG FileRepMalware [Rat]
Cybereason malicious.69d353
DeepInstinct MALICIOUS
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 912
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 912
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 912
1 0 0

NtResumeThread

 thread_handle: 0x00000244
suspend_count: 1
process_identifier: 912
1 0 0

CreateProcessInternalW

 thread_identifier: 2508
thread_handle: 0x0000024c
process_identifier: 2504
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\plugmanzx.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\plugmanzx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000250
1 1 0

NtGetContextThread

 thread_handle: 0x0000024c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2504
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
3221225496 0

CreateProcessInternalW

 thread_identifier: 2544
thread_handle: 0x00000260
process_identifier: 2540
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\plugmanzx.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\plugmanzx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000264
1 1 0

NtGetContextThread

 thread_handle: 0x00000260
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 528384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $<‰ä%xèŠvxèŠvxèŠvÌt{vkèŠvÌtyvßèŠvÌtxvfèŠvqvyèŠvæHMvzèŠvÕ¶‰wbèŠvÕ¶wBèŠvÕ¶ŽwZèŠvqvaèŠvxè‹vBéŠvͶƒwèŠvͶuvyèŠvͶˆwyèŠvRichxèŠvPELÿìÀdà l D€@€HÞ€ÄJÐH;àÂ8tÃÃ@€ì.text…kl `.rdataüx€zp@@.data]ê@À.tls `ø@À.gfids0pú@@.rsrcÄJ€Lþ@@.relocH;Ð<J@B
base_address: 0x00400000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00458000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ¬ÅE°ÈEªÅE..€G\G\G\G\G\G\G\G\G\G„G`G`G`G`G`G`G`GˆGÿÿÿÿ°ÈE¨G¨G¨G¨G¨GˆG0ËE°ÌEøÚEèG€GCPSTPDT°GðGÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€Gþÿÿÿþÿÿÿu˜Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ¶FEA$¶F½GA0¶FÜDA´†E.?AVtype_info@@´†E.?AVbad_alloc@std@@´†E.?AVbad_array_new_length@std@@´†E.?AVlogic_error@std@@´†E.?AVlength_error@std@@´†E.?AVout_of_range@std@@´†E.?AV_Facet_base@std@@´†E.?AV_Locimp@locale@std@@´†E.?AVfacet@locale@std@@´†E.?AU_Crt_new_delete@std@@´†E.?AVcodecvt_base@std@@´†E.?AUctype_base@std@@´†E.?AV?$ctype@D@std@@´†E.?AV?$codecvt@DDU_Mbstatet@@@std@@´†E.?AVbad_exception@std@@´†E.H´†E.?AVfailure@ios_base@std@@´†E.?AVruntime_error@std@@´†E.?AVsystem_error@std@@´†E.?AVbad_cast@std@@´†E.?AV_System_error@std@@´†E.?AVexception@std@@
base_address: 0x00470000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x00476000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: f5K5§>ñ9 :§>Y:§>iê§>í —µ–:}}P:nõ]õ‘R9R§>§>_‡²†:ß9î 5HW  ðz®}°ºˆ»áà3@œ†Ó#·•‡DË6;4]Le b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x00477000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00478000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0047d000
process_identifier: 2540
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2540
process_handle: 0x00000264
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4408333
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2540
1 0 0

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2540
1 0 0