Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 11, 2023, 8:50 a.m.	Aug. 11, 2023, 8:53 a.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d525784068f44c8c06b97756f67bca48`
SHA256	`f8125e4ec3ac9a91641133259d6096405cbb989fa716b533874bd248519be3b9`
CRC32	`263CF16D`
ssdeep	`24576:ydBXwq3wYbKJxMZGmjBB/n0dSmsmIfKNzeAE/Nh/P0tqSQ:+XJbKJxM8MY0msmIfKtenn/PKqZ`
PDB Path	C:\A10\yhxgu3wk074\output.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

38h4tp20bm85.exe "C:\Users\test22\AppData\Local\Temp\38h4tp20bm85.exe"
1072
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2124

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 121.254.136.27 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net	23.67.53.17
luminance-films.ru	A 172.67.206.148 A 104.21.42.155	104.21.42.155

IP Address	Status	Action
121.254.136.27	Active	Moloch
164.124.101.2	Active	Moloch
172.67.206.148	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 11, 2023, 8:50 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 11, 2023, 8:50 a.m.			0	0
IsDebuggerPresent Aug. 11, 2023, 8:50 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\A10\yhxgu3wk074\output.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 11, 2023, 8:50 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.textbss
section	.silen
section	.00cfg

The executable uses a known packer (1 event)

packer

Microsoft Visual C++ V8.0 (Debug)

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 11, 2023, 8:50 a.m.	stacktrace: 38h4tp20bm85+0x61125 @ 0x10d1125 38h4tp20bm85+0x660f9 @ 0x10d60f9 38h4tp20bm85+0x673fc @ 0x10d73fc RtlSelfRelativeToAbsoluteSD+0x1e8 TpPostWork-0x48 ntdll+0x78449 @ 0x77918449 TpCallbackIndependent+0x527 RtlIsCriticalSectionLockedByThread-0x240 ntdll+0x454f4 @ 0x778e54f4 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 11400652 registers.edi: 8921088 registers.eax: 2124 registers.ebp: 11400668 registers.edx: 2130553844 registers.ebx: 512 registers.esi: 18670096 registers.ecx: 2112	1	0	0
__exception__ Aug. 11, 2023, 8:50 a.m.	stacktrace: 38h4tp20bm85+0x6b4c8 @ 0x10db4c8 38h4tp20bm85+0x694ea @ 0x10d94ea 38h4tp20bm85+0x6661e @ 0x10d661e BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc0000005 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1963792 registers.edi: 1963996 registers.eax: 1963792 registers.ebp: 1963872 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 3127676 registers.ecx: 2	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 11, 2023, 8:50 a.m.

stacktrace:

38h4tp20bm85+0x61125 @ 0x10d1125
38h4tp20bm85+0x660f9 @ 0x10d60f9
38h4tp20bm85+0x673fc @ 0x10d73fc
RtlSelfRelativeToAbsoluteSD+0x1e8 TpPostWork-0x48 ntdll+0x78449 @ 0x77918449
TpCallbackIndependent+0x527 RtlIsCriticalSectionLockedByThread-0x240 ntdll+0x454f4 @ 0x778e54f4
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 11400652
registers.edi: 8921088
registers.eax: 2124
registers.ebp: 11400668
registers.edx: 2130553844
registers.ebx: 512
registers.esi: 18670096
registers.ecx: 2112

__exception__

Aug. 11, 2023, 8:50 a.m.

stacktrace:

38h4tp20bm85+0x6b4c8 @ 0x10db4c8
38h4tp20bm85+0x694ea @ 0x10d94ea
38h4tp20bm85+0x6661e @ 0x10d661e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc0000005
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1963792
registers.edi: 1963996
registers.eax: 1963792
registers.ebp: 1963872
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 3127676
registers.ecx: 2

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

luminance-films.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 98 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 1072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011ce000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 1072 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d6b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d82000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c9a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00605000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00607000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x713b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74681000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71341000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x712d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71231000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x711d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71131000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x710f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x710b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71051000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71041000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00761000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00762000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x044bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x044b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (50 out of 239 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\databases\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jkjgekcefbkpogohigkgooodolhdgcda
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsMostVisited\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\1.0.0.13\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\0.57.44.2492\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\profiles.ini
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\43\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\91.265.200\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsRecentClosed\Local State

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 11, 2023, 8:50 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00012800', u'virtual_address': u'0x0016e000', u'entropy': 7.562344683767987, u'name': u'.rsrc', u'virtual_size': u'0x000126bd'}

entropy

7.56234468377

description

A section with a high entropy has been found

Yara rule detected in process memory (11 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Detection of Virtual Appliances through the use of WMI for use of evasion.	rule	WMI_VM_Detect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Win32 PWS Loki	rule	Win32_PWS_Loki_m_Zero

Executes one or more WMI queries which can be used to identify virtual machines (5 events)

wmi	SELECT * FROM Win32_Processor
wmi	associators of {\\TEST22-PC\root\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
wmi	SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
wmi	Select * From Win32_ComputerSystem
wmi	associators of {\\TEST22-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 2c1e6e871a8c752882523593ed13078aa3b0443f

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 11, 2023, 8:50 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Attempts to access Bitcoin/ALTCoin wallets (50 out of 356 events)

file	C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Document Building Blocks\1042\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\7zO4B1094CA\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Windows\WER\ReportQueue\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\TCDDC51.tmp\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\chrome_BITS_6916_1520674847\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\VersionManager\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\TCDDA6C.tmp\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Office\wallet.dat
file	C:\Users\test22\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\WR7LLTJC\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\Setup000023ac\wallet.dat
file	C:\Users\test22\AppData\Local\Google\wallet.dat
file	C:\Users\test22\AppData\Local\Mozilla\wallet.dat
file	C:\Users\test22\AppData\Local\pip\cache\http\0\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Windows\1024\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Themes\wallet.dat
file	C:\Users\test22\AppData\Local\Thunderbird\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Outlook\RoamCache\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\acrord32_sbx\lilo.3008\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\wallet.dat
file	C:\Users\test22\AppData\Local\Adobe\Updater6\Install\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\TCDDBD6.tmp\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Network\Connections\wallet.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\VirtualBox Dropped Files\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Office\wallet.dat
file	C:\Users\test22\AppData\Local\Temporary Internet Files\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\Low\wallet.dat
file	C:\Users\test22\AppData\Local\MSfree Inc\wallet.dat
file	C:\Users\test22\AppData\Local\Microsoft\Windows\1042\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\wallet.dat
file	C:\Users\test22\AppData\Roaming\Mozilla\Extensions\wallet.dat
file	C:\Users\test22\AppData\Roaming\Adobe\LogTransport2\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\MMC\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\PrivacIE\wallet.dat
file	C:\Users\test22\AppData\Local\Mozilla\Firefox\Profiles\mordc3o0.default\wallet.dat
file	C:\Users\test22\AppData\Local\Adobe\Color\Profiles\wallet.dat
file	C:\Users\test22\AppData\Local\pip\cache\http\d\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\wallet.dat
file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\g8t0pe67.default-release\Mail\wallet.dat
file	C:\Users\test22\AppData\Local\Temp\msdtadmin\wallet.dat
file	C:\Users\test22\AppData\Roaming\HNC\User\Hwp\wallet.dat
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\wallet.dat

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Executes one or more WMI queries (8 events)

wmi	select * from Win32_VideoController
wmi	Select * from AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	associators of {\\TEST22-PC\root\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
wmi	Select * From Win32_ComputerSystem
wmi	associators of {\\TEST22-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor
wmi	SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 11, 2023, 8:50 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2124 process_handle: 0x00000078	1	1	0

Harvests credentials from local email clients (1 event)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1072 called NtSetContextThread to modify thread in remote process 2124
NtSetContextThread Aug. 11, 2023, 8:50 a.m.	registers.eip: 2005598660 registers.esp: 2423300 registers.edi: 0 registers.eax: 4450670 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000074 process_identifier: 2124	1	0	0

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1072 resumed a thread in remote process 2124
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000074 suspend_count: 1 process_identifier: 2124	1	0	0

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 11, 2023, 8:50 a.m.	thread_identifier: 2128 thread_handle: 0x00000074 process_identifier: 2124 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000078	1	1
NtGetContextThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000074	1	0
NtAllocateVirtualMemory Aug. 11, 2023, 8:50 a.m.	process_identifier: 2124 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0
WriteProcessMemory Aug. 11, 2023, 8:50 a.m.	buffer: base_address: 0x00400000 process_identifier: 2124 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 11, 2023, 8:50 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2124 process_handle: 0x00000078	1	1
NtSetContextThread Aug. 11, 2023, 8:50 a.m.	registers.eip: 2005598660 registers.esp: 2423300 registers.edi: 0 registers.eax: 4450670 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000074 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000074 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x000001b4 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000380 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x000005b4 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x0000060c suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000620 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x000006c4 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x00000724 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x000006dc suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x000006d0 suspend_count: 1 process_identifier: 2124	1	0
NtResumeThread Aug. 11, 2023, 8:50 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2124	1	0

38h4tp20bm85.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All