Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 25, 2023, 7:34 a.m.	Aug. 25, 2023, 7:37 a.m.

Size	543.0KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`6d6ccdc462b1a9f6a53f1c193f3120a3`
SHA256	`fd9173d4873cc064aeaa261931ad15731d47fc009e8dd4f96c157793f8745b0e`
CRC32	`09D7F52D`
ssdeep	`12288:IuQdpdQrou2mUKWmtnfNiPKaGgr9NaYb4wdvInb6/i/uQjCHzn6yd0y:O8o9KWmxYPKaGgJsKo1uIYznDd0y`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

Vr0mqRZpkNshedy.exe "C:\Users\test22\AppData\Local\Temp\Vr0mqRZpkNshedy.exe"
1664
- jsc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  3024

Name	Response	Post-Analysis Lookup
api.ipify.org	A 64.185.227.156 CNAME api4.ipify.org A 104.237.62.211 A 173.231.16.76	173.231.16.76

IP Address	Status	Action
104.237.62.211	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 104.237.62.211:443 -> 192.168.56.103:49166	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 104.237.62.211:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 25, 2023, 7:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 25, 2023, 7:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 25, 2023, 7:35 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 25, 2023, 7:35 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 25, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 7:34 a.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 7:35 a.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 7:35 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 25, 2023, 7:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000001225b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 25, 2023, 7:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000122ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 25, 2023, 7:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000122ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 25, 2023, 7:34 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 25, 2023, 7:35 a.m.	stacktrace: 0x6c0a04 0x6c08d6 0x6c0719 0x6c00e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73d7264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73d72e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73e274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73e27610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73eb1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73eb1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73eb1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73eb416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7469f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74797f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74794de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c3ced registers.esp: 4059476 registers.edi: 4059500 registers.eax: 0 registers.ebp: 4059512 registers.edx: 195 registers.ebx: 37836464 registers.esi: 37873220 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Aug. 25, 2023, 7:35 a.m.

stacktrace:

0x6c0a04
0x6c08d6
0x6c0719
0x6c00e8
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73d7264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73d72e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73e274ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73e27610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73eb1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73eb1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73eb1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73eb416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7469f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74797f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74794de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6c3ced
registers.esp: 4059476
registers.edi: 4059500
registers.eax: 0
registers.ebp: 4059512
registers.edx: 195
registers.ebx: 37836464
registers.esi: 37873220
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 121 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c5b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35c4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93edc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 7:34 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Looks up the external IP address (1 event)

domain

api.ipify.org

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 25, 2023, 7:35 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00087200', u'virtual_address': u'0x00002000', u'entropy': 7.998747213005842, u'name': u'.text', u'virtual_size': u'0x000870d8'}

entropy

7.99874721301

description

A section with a high entropy has been found

entropy

0.996313364055

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 25, 2023, 7:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Aug. 25, 2023, 7:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (12 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications smtp	rule	Network_SMTP_dotNet
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

Terminates another process (28 events)

Time & API	Arguments	Status
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2512 process_handle: 0x0000000000000240
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2512 process_handle: 0x0000000000000240	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2556 process_handle: 0x000000000000024c
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2556 process_handle: 0x000000000000024c	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2592 process_handle: 0x0000000000000254
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2592 process_handle: 0x0000000000000254	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2628 process_handle: 0x000000000000025c
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2628 process_handle: 0x000000000000025c	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2664 process_handle: 0x0000000000000264
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2664 process_handle: 0x0000000000000264	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2700 process_handle: 0x000000000000026c
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2700 process_handle: 0x000000000000026c	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2736 process_handle: 0x0000000000000274
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2736 process_handle: 0x0000000000000274	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2772 process_handle: 0x000000000000027c
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2772 process_handle: 0x000000000000027c	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2808 process_handle: 0x0000000000000284
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2808 process_handle: 0x0000000000000284	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2844 process_handle: 0x000000000000028c
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2844 process_handle: 0x000000000000028c	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2880 process_handle: 0x0000000000000294
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2880 process_handle: 0x0000000000000294	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2916 process_handle: 0x000000000000029c
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2916 process_handle: 0x000000000000029c	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2952 process_handle: 0x00000000000002a4
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2952 process_handle: 0x00000000000002a4	1
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2988 process_handle: 0x00000000000002ac
NtTerminateProcess Aug. 25, 2023, 7:35 a.m.	status_code: 0xffffffff process_identifier: 2988 process_handle: 0x00000000000002ac	1

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
cmdline	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
cmdline	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 003da9d5ac7bf96d461ee4dd5a100c7f064dfd9f
buffer	Buffer with sha1: 62a4e9e86fd5b402c3aaf18a4d33aa4619338fc2

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 25, 2023, 7:35 a.m.	process_identifier: 3024 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002a8	1	0	0

A process attempted to delay the analysis task. (1 event)

description

jsc.exe tried to sleep 2728223 seconds, actually delayed analysis time by 2728223 seconds

Harvests credentials from local FTP client softwares (5 events)

file	C:\Users\test22\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\SOFTWARE\FTPWare\COREFTP\Sites

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Aug. 25, 2023, 7:35 a.m.	thread_identifier: 0 callback_function: 0x006508a2 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	1704317	0

Harvests credentials from local email clients (6 events)

file	C:\Users\test22\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect
file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1664 resumed a thread in remote process 3024
NtResumeThread Aug. 25, 2023, 7:35 a.m.	thread_handle: 0x00000000000002ac suspend_count: 1 process_identifier: 3024	1	0	0

Vr0mqRZpkNshedy.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All