popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

skxeYqr.exe

.NET framework(MSIL) UPX Socket DNS persistence AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 6, 2023, 10:12 a.m. Oct. 6, 2023, 10:20 a.m.
Size 468.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 20bb118569b859e64feaaf30227e04b8
SHA256 c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
CRC32 B3187285
ssdeep 12288:dSR2NCo5jqK0UwKya66xXPeOuesG17eVpD0B5BbXv3VlRU3nFRg+e:5NCo5jqK0UwKya66xXPeOuersP07Bj3Z
Yara
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00602810
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00602890
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00602890
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00505000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0050b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00507000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007cd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ce000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007cf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048a9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 38400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05080400
process_handle: 0xffffffff
3221225550 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052c9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052cd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05080178
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x050801a0
process_handle: 0xffffffff
3221225550 0
section {u'size_of_data': u'0x00074400', u'virtual_address': u'0x00002000', u'entropy': 7.117528511632164, u'name': u'.text', u'virtual_size': u'0x000743a4'} entropy 7.11752851163 description A section with a high entropy has been found
entropy 0.994652406417 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Install itself for autorun at Windows startup rule Persistence
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2156
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
1 0 0

NtProtectVirtualMemory

 process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0x0000045c
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description skxeYqr.exe tried to sleep 2728231 seconds, actually delayed analysis time by 2728231 seconds
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x00400000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFF¬BêCÈ@B–E$@äA8F@ðBØF AàBGü@pBPGŒ@€B:Hœ@FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFFVCreateWindowExAƒDefWindowProcA“DispatchMessageA"GetMessageA”LoadCursorA˜LoadIconAÕPostQuitMessageàRegisterClassAHShowWindow^TranslateMessagejUpdateWindow}wsprintfAuser32.dll#CloseHandle9CreateEventA=CreateFileAJCreateMutexAVCreateThread›ExitProcess¤FileTimeToSystemTimeæGetCommandLineAGetCurrentProcess)GetLocalTime2GetModuleFileNameA4GetModuleHandleA„GetTempPathA˜GetVolumeInformationAðLocalAllocôLocalFreeOpenMutexA€SetEvent…SetFilePointer·Sleep¼SystemTimeToFileTimeÙVirtualAllocÛVirtualFreeèWaitForSingleObject÷WriteFilekernel32.dllGetSidSubAuthorityGetTokenInformation˜OpenProcessToken·RegCloseKey»RegCreateKeyExAÀRegDeleteValueAÐRegOpenKeyExAçRegSetValueExAadvapi32.dll!WSAStartup&closesocket'connect5htons6inet_addr8inet_ntoa9ioctlsocket>recvCselectDsendGsetsockoptHshutdownIsocketwsock32.dll(WSAIoctlWfreeaddrinfoXgetaddrinfows2_32.dllCoCreateInstance8CoInitializedCoUninitializeole32.dllAcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessageFreeContextBufferFreeCredentialsHandleGetUserNameExAGetUserNameExWInitializeSecurityContextA*QueryContextAttributesAsecur32.dll
base_address: 0x00404000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: ™£q(¤‚ùL”¼ ÎAQg„§Þ€+•#Ž†÷öØ»¨u¸noÛæ6aêƸÕ¼CU6k üÔâ® ó â«Ô§ªBŠ[rn3ynÛæ6aêƸÕ¼CU6k üÔªá_§»âšØð€!‰T"3)5oÛæ6aêƸÕ¼CU6k üÔªá_§»âšØ ÂÒu¸no­üà<socks5Software\Microsoft\Windows\CurrentVersion\Runwin32appMicrosoftpowershell.exe -windowstyle hidden -Command "& '%s'"*Ջ«¢Î±ªS'Ջ«¢Î±ªS$Ջ«¢Î±ªS Ջ«¢Î±ªS ÀFGET %s HTTP/1.0 Host: %s User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close Microsoft Unified Security Protocol Provider
base_address: 0x00405000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: D000"0O0T0k0¶0ï0ô0+3<3a3r3ë3ü3G4ø5+6Ú6ë7;8M8·9q:ú:ÿ:Ò<å< 4000"0a0g0ë0Ë1Ù122'24406U8h8Ÿ8²8É:Œ<z>0œÜ4â4è4î4ô4ú455 5555$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5„5Š55–5œ5¢5¨5®5´5º5À5Æ5Ì5Ò5Ø5Þ5ä5ê5ð5ö5ü566666 6&6,62686>6D6J6P6V6\6b6h6n6t6z6€6†6Œ6’6
base_address: 0x00406000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2156
process_handle: 0x0000045c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x00400000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0
Process injection Process 1372 called NtSetContextThread to modify thread in remote process 2156
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4198400
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000458
process_identifier: 2156
1 0 0
file C:\Users\test22\AppData\Local\Temp\skxeYqr.exe\:Zone.Identifier
Process injection Process 1372 resumed a thread in remote process 2156
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000458
suspend_count: 1
process_identifier: 2156
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x000003f8
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x0000041c
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x00000430
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x00000444
suspend_count: 1
process_identifier: 1372
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1372
1 0 0

CreateProcessInternalW

 thread_identifier: 2160
thread_handle: 0x00000458
process_identifier: 2156
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\skxeYqr.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\skxeYqr.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\skxeYqr.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000045c
1 1 0

NtGetContextThread

 thread_handle: 0x00000458
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2156
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x00400000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFF¬BêCÈ@B–E$@äA8F@ðBØF AàBGü@pBPGŒ@€B:Hœ@FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFFVCreateWindowExAƒDefWindowProcA“DispatchMessageA"GetMessageA”LoadCursorA˜LoadIconAÕPostQuitMessageàRegisterClassAHShowWindow^TranslateMessagejUpdateWindow}wsprintfAuser32.dll#CloseHandle9CreateEventA=CreateFileAJCreateMutexAVCreateThread›ExitProcess¤FileTimeToSystemTimeæGetCommandLineAGetCurrentProcess)GetLocalTime2GetModuleFileNameA4GetModuleHandleA„GetTempPathA˜GetVolumeInformationAðLocalAllocôLocalFreeOpenMutexA€SetEvent…SetFilePointer·Sleep¼SystemTimeToFileTimeÙVirtualAllocÛVirtualFreeèWaitForSingleObject÷WriteFilekernel32.dllGetSidSubAuthorityGetTokenInformation˜OpenProcessToken·RegCloseKey»RegCreateKeyExAÀRegDeleteValueAÐRegOpenKeyExAçRegSetValueExAadvapi32.dll!WSAStartup&closesocket'connect5htons6inet_addr8inet_ntoa9ioctlsocket>recvCselectDsendGsetsockoptHshutdownIsocketwsock32.dll(WSAIoctlWfreeaddrinfoXgetaddrinfows2_32.dllCoCreateInstance8CoInitializedCoUninitializeole32.dllAcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessageFreeContextBufferFreeCredentialsHandleGetUserNameExAGetUserNameExWInitializeSecurityContextA*QueryContextAttributesAsecur32.dll
base_address: 0x00404000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: ™£q(¤‚ùL”¼ ÎAQg„§Þ€+•#Ž†÷öØ»¨u¸noÛæ6aêƸÕ¼CU6k üÔâ® ó â«Ô§ªBŠ[rn3ynÛæ6aêƸÕ¼CU6k üÔªá_§»âšØð€!‰T"3)5oÛæ6aêƸÕ¼CU6k üÔªá_§»âšØ ÂÒu¸no­üà<socks5Software\Microsoft\Windows\CurrentVersion\Runwin32appMicrosoftpowershell.exe -windowstyle hidden -Command "& '%s'"*Ջ«¢Î±ªS'Ջ«¢Î±ªS$Ջ«¢Î±ªS Ջ«¢Î±ªS ÀFGET %s HTTP/1.0 Host: %s User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close Microsoft Unified Security Protocol Provider
base_address: 0x00405000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: D000"0O0T0k0¶0ï0ô0+3<3a3r3ë3ü3G4ø5+6Ú6ë7;8M8·9q:ú:ÿ:Ò<å< 4000"0a0g0ë0Ë1Ù122'24406U8h8Ÿ8²8É:Œ<z>0œÜ4â4è4î4ô4ú455 5555$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5„5Š55–5œ5¢5¨5®5´5º5À5Æ5Ì5Ò5Ø5Þ5ä5ê5ð5ö5ü566666 6&6,62686>6D6J6P6V6\6b6h6n6t6z6€6†6Œ6’6
base_address: 0x00406000
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2156
process_handle: 0x0000045c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4198400
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000458
process_identifier: 2156
1 0 0

NtResumeThread

 thread_handle: 0x00000458
suspend_count: 1
process_identifier: 2156
1 0 0
Bkav W32.Common.AA3D2AB3
Lionic Trojan.Win32.Inject.1b!c
Elastic malicious (high confidence)
DrWeb Trojan.Proxy2.1863
MicroWorld-eScan Trojan.GenericKD.69358581
FireEye Generic.mg.20bb118569b859e6
CAT-QuickHeal Trojan.MSIL
ALYac Trojan.GenericKD.69358581
Malwarebytes Trojan.DACrypt.MSIL.Generic
VIPRE Trojan.GenericKD.69358581
Sangfor Trojan.Msil.Inject.Vkx3
K7AntiVirus Trojan ( 005ab6fd1 )
Alibaba Trojan:MSIL/Inject.67865c0b
K7GW Trojan ( 005ab6fd1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D42253F5
BitDefenderTheta Gen:NN.ZemsilF.36722.Dm0@ai4ERHg
VirIT Trojan.Win32.MSIL_Heur.A
Cyren W32/MSIL_Agent.GLR.gen!Eldorado
Symantec Trojan Horse
ESET-NOD32 a variant of MSIL/Kryptik.AJRH
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.Inject.gen
BitDefender Trojan.GenericKD.69358581
Avast Win32:TrojanX-gen [Trj]
Tencent Malware.Win32.Gencirc.13efefe5
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Coroxy.tnvhc
Zillya Trojan.Inject.Win32.343701
TrendMicro Backdoor.Win32.SYSTEMBC.YXDISZ
McAfee-GW-Edition BehavesLike.Win32.AgentTesla.gc
Trapmine malicious.high.ml.score
Emsisoft Trojan.GenericKD.69358581 (B)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.MSIL.aotkd
Avira TR/AD.Coroxy.tnvhc
MAX malware (ai score=80)
Antiy-AVL Trojan/MSIL.Inject
Gridinsoft Malware.Win32.Gen.bot
Xcitium Malware@#xhgmvmmcx4yl
Microsoft Trojan:MSIL/Malgent!MSR
ZoneAlarm HEUR:Trojan.MSIL.Inject.gen
GData Trojan.GenericKD.69358581
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5490595
McAfee Artemis!20BB118569B8
VBA32 TScope.Trojan.MSIL
Cylance unsafe
Panda Trj/Genetic.gen