popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

build5555.exe

Malicious Library UPX Malicious Packer Code injection ScreenShot Http API Internet API Socket AntiDebug PE64 PE File OS Processor Check AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 7, 2023, 2:47 p.m. Oct. 7, 2023, 2:50 p.m.
Size 1.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 82eecea4083e39c33733428c2d845b15
SHA256 ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef
CRC32 99363D82
ssdeep 24576:Yr3uXCxRUKRErpNT3ixen3EyJvRvEx+aFwGSMn/FQiG654Sr:Yreyx7ErOe3XvRvRayM/FU+4s
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
95.181.173.8 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section _RDATA
file C:\Users\test22\AppData\Local\Temp\a.exe:extractor.dll
section {u'size_of_data': u'0x00140800', u'virtual_address': u'0x00022000', u'entropy': 7.82414430289428, u'name': u'.rdata', u'virtual_size': u'0x00140696'} entropy 7.82414430289 description A section with a high entropy has been found
entropy 0.896817068905 description Overall entropy of this PE file is high
description Communications over RAW Socket rule Network_TCP_Socket
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
host 95.181.173.8
file C:\Users\test22\AppData\Local\Temp\a.exe:extractor.dll
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2056
region_size: 1167360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000002c
1 0 0
Process injection Process 1984 manipulating memory of non-child process 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 0
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 3501386814
protection: 1 (PAGE_NOACCESS)
base_address: 0x0000000000000000
process_handle: 0x0000000001234567
-1073741816 0

NtProtectVirtualMemory

 process_identifier: 0
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 3970473622
protection: 1 (PAGE_NOACCESS)
base_address: 0x0000000000000000
process_handle: 0x0000000001234567
-1073741816 0

NtProtectVirtualMemory

 process_identifier: 0
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 3970473622
protection: 1 (PAGE_NOACCESS)
base_address: 0x0000000000000000
process_handle: 0x0000000001234567
-1073741816 0

NtProtectVirtualMemory

 process_identifier: 0
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 3970473622
protection: 1 (PAGE_NOACCESS)
base_address: 0x0000000000000000
process_handle: 0x0000000001234567
-1073741816 0

NtProtectVirtualMemory

 process_identifier: 0
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 3970473622
protection: 1 (PAGE_NOACCESS)
base_address: 0x0000000000000000
process_handle: 0x0000000001234567
-1073741816 0

NtProtectVirtualMemory

 process_identifier: 0
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x0000000000000000
process_handle: 0x0000000000000000
-1073741583 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $éŠd9­ë j­ë j­ë jæ“ k¬ë jæ“ k¬ë j¸”kðë j¸”k¢ë j¸” k¥ë jæ“kë jæ“ kªë jæ“k¿ë j­ë jYë jæ“ k¶ë j›kk§ë j›kõj¬ë j›kk¬ë jRich­ë jPEd†s eð" %îœ3@Ð`°ê°àPŒFÀ àå8€æ( ä@0.textÀíî `.rdata†ÿò@@.datatBò@À.pdataŒFPH@@_RDATA\ X@@.rsrcà°Z@@.reloc À \@B
base_address: 0x0000000140000000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: ÎL´MM?MºMŸMMM­MuMfMðLƒMPM(MÐL–OOOsOeOQO=O)OOÆP¿P±P£P•PPmPYPEP"RR RÿQñQãQÕQÇQ¹Q’SŽS›S‰SÄS´S—S…SêS×SàSÉSÀS°S“SSUU UUÿTõTëTáT×TÛUÔUÍUÆU¿UµU«U¡U—UÃV¼VµV®V§V V™V’V‹V
base_address: 0x000000014011a000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: €0€ H`°}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x000000014011b000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: $0¦8¦@¦H¦P¦`¦p¦x¦€¦ˆ¦¦˜¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§€§ˆ§§˜§°§¸§À§È§Ð§Ø§à§è§¨¨ ¨P¨X¨`¨€¨ˆ¨¨˜¨ ¨¨¨Ø¨à¨è¨ð¨ø¨©©© ©(©0©8©@©H©P©X©h©p©x©€©ˆ©©˜©¸©À©È©è©ð©ø©¬ ¬(¬0¬8¬à¬è¬ð¬ø¬­@­H­P­X­`­h­p­x­€­ˆ­­˜­ ­¨­Ø­à­è­®®®®@®H®P®X®`®h®p®x®€®ˆ®®˜® ®¨®°®ð¯ø¯Ü      ( 0 8 @ H X ` h p x € ˆ  ˜ È¦Ð¦Ø¦à¦è¦ð¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§€§ˆ§§˜§ §¨§°§¸§À§È§Ð§Ø§à§è§ð§ø§¨¨¨ ¨(¨0¨x¨€¨ˆ¨°¨¸¨À¨è¨ð¨ø¨ð­ø­®®®® ®(®0®8®@®H®P®X®`®h®p®x®€®ˆ®˜®¨®¨¯°¯¸¯À¯È¯Ð¯Ø¯à¯è¯ð¯ø¯     `¢h¢p¢x¢€¢@Уà£è£ð£ø£¤¤¤¤ ¤(¤0¤8¤@¤H¤P¤X¤ ¥(¥0¥8¥@¥H¥P¥X¥`¥h¥p¥x¥€¥ˆ¥¥˜¥ ¥¨¥°¥¸¥À¥È¥Ð¥Ø¥à¥è¥ð¥ø¥¦¦¦¦ ¦(¦0¦8¦@¦H¦P¦X¦`¦h¦p¦€¦ˆ¦¦˜¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§€§ˆ§§˜§ §¨§°§¸§À§È§Ð§Ø§ ¬(¬0¬8¬@¬H¬P¬X¬`¬h¬p¬x¬€¬ˆ¬¬˜¬ ¬¨¬°¬¸¬À¬Plà£è£ð£ø£¤¤¤¤ ¤(¤0¤8¤@¤H¤P¤X¤È¤Ø¤è¤ø¤¥¥(¥8¥H¥X¥h¥x¥ˆ¥˜¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦ˆ¦à¯è¯ð¯ø¯`¸ ¡0¡@¡P¡`¡p¡€¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢€¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£€££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤€¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥@¥P¥`¥p¥€¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦€¦¦ ¦pÐH¡X¡h¡x¡ˆ¡˜¡¨¡¸¡È¡Ø¡è¡ø¡¢¢(¢8¢H¢X¢h¢x¢ˆ¢˜¢¨¢¸¢È¢Ø¢è¢ø¢££(£8£H£X£h£x£ˆ£˜£¨£¸£È£Ø£è£ø£¤¤(¤8¤H¤X¤h¤x¤ˆ¤˜¤¨¤¸¤È¤Ø¤è¤ø¤¥¥(¥8¥H¥X¥h¥x¥ˆ¥˜¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦ˆ¦˜¦¨¦¸¦È¦Ø¦è¦ø¦§§(§8§H§X§h§x§ˆ§˜§¨§¸§È§Ø§è§ø§¨¨(¨8¨H¨X¨h¨x¨ˆ¨˜¨¨¨¸¨È¨Ø¨è¨ø¨©©(©8©H©X©h©x©ˆ©˜©¨©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªˆª˜ª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«ˆ«˜«¨«¸«È«Ø«è«ø«¬¬(¬8¬H¬X¬h¬x¬ˆ¬˜¬¨¬¸¬È¬Ø¬è¬ø¬­­(­8­H­X­h­x­ˆ­˜­¨­¸­È­Ø­è­ø­®®(®8®H®X®h®x®ˆ®˜®¨®¸®È®Ø®è®ø®¯¯(¯8¯H¯X¯h¯x¯€” «°«À«Ð«à«ð«¬¬ ¬0¬@¬P¬`¬p¬€¬¬ ¬°¬À¬Ð¬à¬ð¬­­ ­0­@­P­`­p­€­­ ­°­À­Ð­à­ð­®® ®0®@®P®`®p®€®® ®°®À®Ð®à®ð®¯¯ ¯0¯@¯P¯`¯p¯€¯¯ ¯°¯À¯Ð¯à¯ð¯D    0 @ P ` p €    ° À Ð à ð ¡¡ ¡0¡@¡P¡`¡p¡€¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢€¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£€££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤€¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥0¥@¥P¥`¥p¥€¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦€¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§€§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨€¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©@©P©`©p©€©© ©°©À©Ð©°ȯЯدà¯ÀøX¡`¡h¡p¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢€¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£€££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤€¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥0¥@¥P¥`¥p¥€¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦€¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§€§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨€¨¨`¯h¯p¯ÐÀX ` h ˆ  ˜   ¨ ° ¸ À È ¨¤¸¤È¤Ø¤è¤ø¤¥¥(¥8¥H¥X¥h¥x¥ˆ¥˜¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦ˆ¦˜¦¨¦¸¦È¦Ø¦è¦ø¦§§(§8§H§X§h§x§ˆ§˜§¨§¸§È§Ø§è§ø§¨¨(¨8¨H¨X¨h¨x¨ˆ¨˜¨¨¨¸¨È¨Ø¨è¨ø¨©©(©8©H©X©h©x©ˆ©à„x € ˆ  Ð Ø à è ð ø ¡¡¡¡ ¡(¡0¡8¡@¡H¡P¡X¡`¡h¡`£p£€£ˆ££˜£ £¨£°£¸£È£Ð£Ø£à£è£ð£ø£¤¤(¤8¤@¤H¤P¤X¤ø¤¥¥ ¥¸¥À¥È¥Ð¥Ø¥€¦ˆ¦¦˜¦hà ð ¡¡ ¡(¡0¡@¡H¡€£ˆ££˜£ £¨£°£¸£À£È£Ø£à£è£ð£ø£¤¤¤¤@¥P¥˜¥¸¥Ø¥ø¥¦H¦`¦h¦p¦¨¦°¦¨¨ ©¨©°©¸©t @ h  ¸ à ¡8¡p¡ˆ¡°¡à¡¢0¢X¢€¢°¢à¢£P£€£Ð£(¤X¤˜¤Ð¤ø¤ ¥P¥x¥ ¥¦(¦P¦x¦À¦§`§°§¨`¨À¨©X©€©Ð© ªpªÈªðª0«À«h¬ˆ¬
base_address: 0x000000014011c000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $éŠd9­ë j­ë j­ë jæ“ k¬ë jæ“ k¬ë j¸”kðë j¸”k¢ë j¸” k¥ë jæ“kë jæ“ kªë jæ“k¿ë j­ë jYë jæ“ k¶ë j›kk§ë j›kõj¬ë j›kk¬ë jRich­ë jPEd†s eð" %îœ3@Ð`°ê°àPŒFÀ àå8€æ( ä@0.textÀíî `.rdata†ÿò@@.datatBò@À.pdataŒFPH@@_RDATA\ X@@.rsrcà°Z@@.reloc À \@B
base_address: 0x0000000140000000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0
Process injection Process 1984 called NtSetContextThread to modify thread in remote process 2056
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 5369639708
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 2358760
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 2003748096
registers.rdx: 8796092862464
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x0000000000000028
process_identifier: 2056
1 0 0
Process injection Process 1984 resumed a thread in remote process 2056
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000028
suspend_count: 1
process_identifier: 2056
1 0 0
dead_host 95.181.173.8:15670
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2060
thread_handle: 0x0000000000000028
process_identifier: 2056
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\build5555.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\build5555.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000000000000002c
1 1 0

NtGetContextThread

 thread_handle: 0x0000000000000028
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2056
region_size: 1167360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000002c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $éŠd9­ë j­ë j­ë jæ“ k¬ë jæ“ k¬ë j¸”kðë j¸”k¢ë j¸” k¥ë jæ“kë jæ“ kªë jæ“k¿ë j­ë jYë jæ“ k¶ë j›kk§ë j›kõj¬ë j›kk¬ë jRich­ë jPEd†s eð" %îœ3@Ð`°ê°àPŒFÀ àå8€æ( ä@0.textÀíî `.rdata†ÿò@@.datatBò@À.pdataŒFPH@@_RDATA\ X@@.rsrcà°Z@@.reloc À \@B
base_address: 0x0000000140000000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140001000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00000001400f0000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140110000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140115000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: ÎL´MM?MºMŸMMM­MuMfMðLƒMPM(MÐL–OOOsOeOQO=O)OOÆP¿P±P£P•PPmPYPEP"RR RÿQñQãQÕQÇQ¹Q’SŽS›S‰SÄS´S—S…SêS×SàSÉSÀS°S“SSUU UUÿTõTëTáT×TÛUÔUÍUÆU¿UµU«U¡U—UÃV¼VµV®V§V V™V’V‹V
base_address: 0x000000014011a000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: €0€ H`°}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x000000014011b000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: $0¦8¦@¦H¦P¦`¦p¦x¦€¦ˆ¦¦˜¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§€§ˆ§§˜§°§¸§À§È§Ð§Ø§à§è§¨¨ ¨P¨X¨`¨€¨ˆ¨¨˜¨ ¨¨¨Ø¨à¨è¨ð¨ø¨©©© ©(©0©8©@©H©P©X©h©p©x©€©ˆ©©˜©¸©À©È©è©ð©ø©¬ ¬(¬0¬8¬à¬è¬ð¬ø¬­@­H­P­X­`­h­p­x­€­ˆ­­˜­ ­¨­Ø­à­è­®®®®@®H®P®X®`®h®p®x®€®ˆ®®˜® ®¨®°®ð¯ø¯Ü      ( 0 8 @ H X ` h p x € ˆ  ˜ È¦Ð¦Ø¦à¦è¦ð¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§€§ˆ§§˜§ §¨§°§¸§À§È§Ð§Ø§à§è§ð§ø§¨¨¨ ¨(¨0¨x¨€¨ˆ¨°¨¸¨À¨è¨ð¨ø¨ð­ø­®®®® ®(®0®8®@®H®P®X®`®h®p®x®€®ˆ®˜®¨®¨¯°¯¸¯À¯È¯Ð¯Ø¯à¯è¯ð¯ø¯     `¢h¢p¢x¢€¢@Уà£è£ð£ø£¤¤¤¤ ¤(¤0¤8¤@¤H¤P¤X¤ ¥(¥0¥8¥@¥H¥P¥X¥`¥h¥p¥x¥€¥ˆ¥¥˜¥ ¥¨¥°¥¸¥À¥È¥Ð¥Ø¥à¥è¥ð¥ø¥¦¦¦¦ ¦(¦0¦8¦@¦H¦P¦X¦`¦h¦p¦€¦ˆ¦¦˜¦ ¦¨¦°¦¸¦À¦È¦Ð¦Ø¦à¦è¦ð¦ø¦§§§§ §(§0§8§@§H§P§X§`§h§p§x§€§ˆ§§˜§ §¨§°§¸§À§È§Ð§Ø§ ¬(¬0¬8¬@¬H¬P¬X¬`¬h¬p¬x¬€¬ˆ¬¬˜¬ ¬¨¬°¬¸¬À¬Plà£è£ð£ø£¤¤¤¤ ¤(¤0¤8¤@¤H¤P¤X¤È¤Ø¤è¤ø¤¥¥(¥8¥H¥X¥h¥x¥ˆ¥˜¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦ˆ¦à¯è¯ð¯ø¯`¸ ¡0¡@¡P¡`¡p¡€¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢€¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£€££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤€¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥@¥P¥`¥p¥€¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦€¦¦ ¦pÐH¡X¡h¡x¡ˆ¡˜¡¨¡¸¡È¡Ø¡è¡ø¡¢¢(¢8¢H¢X¢h¢x¢ˆ¢˜¢¨¢¸¢È¢Ø¢è¢ø¢££(£8£H£X£h£x£ˆ£˜£¨£¸£È£Ø£è£ø£¤¤(¤8¤H¤X¤h¤x¤ˆ¤˜¤¨¤¸¤È¤Ø¤è¤ø¤¥¥(¥8¥H¥X¥h¥x¥ˆ¥˜¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦ˆ¦˜¦¨¦¸¦È¦Ø¦è¦ø¦§§(§8§H§X§h§x§ˆ§˜§¨§¸§È§Ø§è§ø§¨¨(¨8¨H¨X¨h¨x¨ˆ¨˜¨¨¨¸¨È¨Ø¨è¨ø¨©©(©8©H©X©h©x©ˆ©˜©¨©¸©È©Ø©è©ø©ªª(ª8ªHªXªhªxªˆª˜ª¨ª¸ªÈªØªèªøª««(«8«H«X«h«x«ˆ«˜«¨«¸«È«Ø«è«ø«¬¬(¬8¬H¬X¬h¬x¬ˆ¬˜¬¨¬¸¬È¬Ø¬è¬ø¬­­(­8­H­X­h­x­ˆ­˜­¨­¸­È­Ø­è­ø­®®(®8®H®X®h®x®ˆ®˜®¨®¸®È®Ø®è®ø®¯¯(¯8¯H¯X¯h¯x¯€” «°«À«Ð«à«ð«¬¬ ¬0¬@¬P¬`¬p¬€¬¬ ¬°¬À¬Ð¬à¬ð¬­­ ­0­@­P­`­p­€­­ ­°­À­Ð­à­ð­®® ®0®@®P®`®p®€®® ®°®À®Ð®à®ð®¯¯ ¯0¯@¯P¯`¯p¯€¯¯ ¯°¯À¯Ð¯à¯ð¯D    0 @ P ` p €    ° À Ð à ð ¡¡ ¡0¡@¡P¡`¡p¡€¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢€¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£€££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤€¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥0¥@¥P¥`¥p¥€¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦€¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§€§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨€¨¨ ¨°¨À¨Ð¨à¨ð¨©© ©0©@©P©`©p©€©© ©°©À©Ð©°ȯЯدà¯ÀøX¡`¡h¡p¡¡ ¡°¡À¡Ð¡à¡ð¡¢¢ ¢0¢@¢P¢`¢p¢€¢¢ ¢°¢À¢Ð¢à¢ð¢££ £0£@£P£`£p£€££ £°£À£Ð£à£ð£¤¤ ¤0¤@¤P¤`¤p¤€¤¤ ¤°¤À¤Ð¤à¤ð¤¥¥ ¥0¥@¥P¥`¥p¥€¥¥ ¥°¥À¥Ð¥à¥ð¥¦¦ ¦0¦@¦P¦`¦p¦€¦¦ ¦°¦À¦Ð¦à¦ð¦§§ §0§@§P§`§p§€§§ §°§À§Ð§à§ð§¨¨ ¨0¨@¨P¨`¨p¨€¨¨`¯h¯p¯ÐÀX ` h ˆ  ˜   ¨ ° ¸ À È ¨¤¸¤È¤Ø¤è¤ø¤¥¥(¥8¥H¥X¥h¥x¥ˆ¥˜¥¨¥¸¥È¥Ø¥è¥ø¥¦¦(¦8¦H¦X¦h¦x¦ˆ¦˜¦¨¦¸¦È¦Ø¦è¦ø¦§§(§8§H§X§h§x§ˆ§˜§¨§¸§È§Ø§è§ø§¨¨(¨8¨H¨X¨h¨x¨ˆ¨˜¨¨¨¸¨È¨Ø¨è¨ø¨©©(©8©H©X©h©x©ˆ©à„x € ˆ  Ð Ø à è ð ø ¡¡¡¡ ¡(¡0¡8¡@¡H¡P¡X¡`¡h¡`£p£€£ˆ££˜£ £¨£°£¸£È£Ð£Ø£à£è£ð£ø£¤¤(¤8¤@¤H¤P¤X¤ø¤¥¥ ¥¸¥À¥È¥Ð¥Ø¥€¦ˆ¦¦˜¦hà ð ¡¡ ¡(¡0¡@¡H¡€£ˆ££˜£ £¨£°£¸£À£È£Ø£à£è£ð£ø£¤¤¤¤@¥P¥˜¥¸¥Ø¥ø¥¦H¦`¦h¦p¦¨¦°¦¨¨ ©¨©°©¸©t @ h  ¸ à ¡8¡p¡ˆ¡°¡à¡¢0¢X¢€¢°¢à¢£P£€£Ð£(¤X¤˜¤Ð¤ø¤ ¥P¥x¥ ¥¦(¦P¦x¦À¦§`§°§¨`¨À¨©X©€©Ð© ªpªÈªðª0«À«h¬ˆ¬
base_address: 0x000000014011c000
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd9010
process_identifier: 2056
process_handle: 0x000000000000002c
1 1 0

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 5369639708
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 2358760
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 2003748096
registers.rdx: 8796092862464
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x0000000000000028
process_identifier: 2056
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000028
suspend_count: 1
process_identifier: 2056
1 0 0
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Doina.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Doina.64443
FireEye Gen:Variant.Doina.64443
Skyhigh BehavesLike.Win64.Generic.tc
McAfee Artemis!82EECEA4083E
Malwarebytes Generic.Malware/Suspicious
VIPRE Gen:Variant.Doina.64443
Sangfor Trojan.Win64.Spyloader.Vkjk
K7GW Riskware ( 00584baa1 )
CrowdStrike win/malicious_confidence_90% (D)
Arcabit Trojan.Doina.DFBBB
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.NBAUNDS
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky Trojan-PSW.Win64.Meduza.af
BitDefender Gen:Variant.Doina.64443
Avast Win64:MalwareX-gen [Trj]
Emsisoft Gen:Variant.Doina.64443 (B)
TrendMicro Trojan.Win64.SMOKELOADER.YXDJGZ
Sophos Mal/Generic-S
Ikarus Trojan.Win64.SpyLoader
Varist W64/ABRisk.UBRB-5811
Antiy-AVL Trojan[PSW]/Win64.Meduza
Microsoft Trojan:Win64/SpyLoader.AB!MTB
ZoneAlarm Trojan-PSW.Win64.Meduza.af
GData Gen:Variant.Doina.64443
Google Detected
ALYac Gen:Variant.Doina.64443
MAX malware (ai score=81)
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win64.SMOKELOADER.YXDJGZ
Rising Stealer.Meduza!8.186B4 (CLOUD)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
AVG Win64:MalwareX-gen [Trj]
DeepInstinct MALICIOUS