Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 23, 2023, 9:33 a.m.	Sept. 23, 2023, 9:35 a.m.

Size	3.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3403cb537d8e1e6257068d3189705050`
SHA256	`1e2ae6c3bc1dce5dc5d968f23da8fec92f2625a6014ca18e3989ad9a33f419d5`
CRC32	`FC82A450`
ssdeep	`98304:OtrbTA1XcptoXinXh6B8WXhT7rQUdUi2p2xIqjsdSympntS:wc1XOtnnXRah84h4qpptS`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware

2ac82382-33f7-4490-a91d-e3cfe4d82faa.exe "C:\Users\test22\AppData\Local\Temp\2ac82382-33f7-4490-a91d-e3cfe4d82faa.exe"
3040
- WinRAR.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exe"
  2200
  - CDS.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\CDS.exe
    2252
    - crypted.exe "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\crypted.exe"
      2440

Name	Response	Post-Analysis Lookup
marcelotatuape.ddns.net	A 141.255.151.60	141.255.151.60

IP Address	Status	Action
141.255.151.60	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
TCP 192.168.56.102:49168 -> 141.255.151.60:333	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 141.255.151.60:333	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 141.255.151.60:333	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2023, 9:33 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 23, 2023, 9:33 a.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 9:33 a.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 9:33 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2023, 9:33 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 23, 2023, 9:33 a.m.	stacktrace: mscorlib+0x216e76 @ 0x71f06e76 mscorlib+0x2202ff @ 0x71f102ff mscorlib+0x216df4 @ 0x71f06df4 CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72891b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x728a8dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x728b6a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x728b6a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x728b6a7d DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x72933191 CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x728e192f CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x728e18cb CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x728e17f1 CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x728e197d DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x72932f62 DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7293303c GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x729f805a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 39 09 e8 d1 5e d4 70 eb 05 e8 56 19 fe 71 b9 1c exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8b02d0 registers.esp: 81982456 registers.edi: 0 registers.eax: 0 registers.ebp: 81982488 registers.edx: 0 registers.ebx: 47136756 registers.esi: 47132912 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 23, 2023, 9:33 a.m.

stacktrace:

mscorlib+0x216e76 @ 0x71f06e76
mscorlib+0x2202ff @ 0x71f102ff
mscorlib+0x216df4 @ 0x71f06df4
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72891b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x728a8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x728b6a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x728b6a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x728b6a7d
DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x72933191
CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x728e192f
CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x728e18cb
CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x728e17f1
CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x728e197d
DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x72932f62
DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7293303c
GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x729f805a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5

exception.instruction_r: 39 09 e8 d1 5e d4 70 eb 05 e8 56 19 fe 71 b9 1c
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x8b02d0
registers.esp: 81982456
registers.edi: 0
registers.eax: 0
registers.ebp: 81982488
registers.edx: 0
registers.ebx: 47136756
registers.esi: 47132912
registers.ecx: 0

Connects to a Dynamic DNS Domain (1 event)

domain

marcelotatuape.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 69 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 3040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73901000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73821000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73121000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73822000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738a3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72eb2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72854000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737b1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fdc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fdb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:33 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd91000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Sept. 23, 2023, 9:33 a.m.	number_of_free_clusters: 2225122 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Sept. 23, 2023, 9:33 a.m.	number_of_free_clusters: 2225122 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\lua51.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\crypted.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\CDS.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\lua5.1.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\aut2797.tmp

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	select * from Win32_Processor

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 23, 2023, 9:34 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

crypted.exe tried to sleep 2728367 seconds, actually delayed analysis time by 2728367 seconds

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

reg_value

rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"

Executes one or more WMI queries (4 events)

wmi	Select * from AntiVirusProduct
wmi	select * from Win32_Processor
wmi	select * from Win32_OperatingSystem
wmi	SELECT * FROM FirewallProduct

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2252 resumed a thread in remote process 2440
NtResumeThread Sept. 23, 2023, 9:33 a.m.	thread_handle: 0x00000480 suspend_count: 1 process_identifier: 2440	1	0	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.lwaI
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.69417846
FireEye	Generic.mg.3403cb537d8e1e62
McAfee	Artemis!3403CB537D8E
Malwarebytes	Malware.AI.2023728049
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanDropper:Win32/Generic.de902c8f
Cybereason	malicious.15f1cc
Arcabit	Trojan.Generic.D4233B76
VirIT	Trojan.Win32.Generic.JKM
Symantec	Trojan.Gen.MBT
tehtris	Generic.Malware
ESET-NOD32	MSIL/Agent.ATK
APEX	Malicious
ClamAV	Win.Malware.Generic-6895514-0
Kaspersky	Backdoor.MSIL.RRAT.mq
BitDefender	Trojan.GenericKD.69417846
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Agen.Zmhl
Emsisoft	Trojan.GenericKD.69417846 (B)
F-Secure	Heuristic.HEUR/AGEN.1321703
DrWeb	Trojan.DownLoader26.52885
VIPRE	Trojan.Dropper.ZNM
McAfee-GW-Edition	BehavesLike.Win32.Agent.wc
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1321703
Gridinsoft	Trojan.Win32.Agent.sa
Microsoft	Trojan:Win32/Znyonm
ZoneAlarm	Backdoor.MSIL.RRAT.mq
GData	Trojan.GenericKD.69417846
Cynet	Malicious (score: 99)
ALYac	Trojan.Dropper.ZNM
MAX	malware (ai score=81)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CIM23
Ikarus	Trojan.Win32.Cab
MaxSecure	Trojan.Autoit.AZA
Fortinet	W32/Agent.RVD!tr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

2ac82382-33f7-4490-a91d-e3cfe4d82faa.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All