Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 7, 2023, 7:03 p.m.	Nov. 7, 2023, 7:07 p.m.

Size	514.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`248fdd80b574b1379fe4f6f1cee40091`
SHA256	`cca71d6b084705ccef5e22e4fc3b185a6bb4a8b9c9c5dfd78bb0cf922ae7ac5d`
CRC32	`EC27399E`
ssdeep	`12288:xVTX2SJq2fUVY6MgJXrjdWxfKkySikDw75KeEG4+4R2y:xVj2SvMigrJW1Xy1YeEGaR7`
PDB Path	Znxl.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

a.exe "C:\Users\test22\AppData\Local\Temp\a.exe"
632
- a.exe "C:\Users\test22\AppData\Local\Temp\a.exe"
  2508
  - images.exe "C:\Users\test22\Documents\images.exe"
    2632
    - images.exe "C:\Users\test22\Documents\images.exe"
      2840
      - cmd.exe "C:\Windows\System32\cmd.exe"
        2928
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
155.94.136.130	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 7, 2023, 7:03 p.m.			0	0
IsDebuggerPresent Nov. 7, 2023, 7:03 p.m.			0	0
IsDebuggerPresent Nov. 7, 2023, 7:03 p.m.			0	0
IsDebuggerPresent Nov. 7, 2023, 7:03 p.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 7, 2023, 7:03 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Nov. 7, 2023, 7:03 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 7, 2023, 7:03 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

Znxl.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 7, 2023, 7:03 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 63 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00282000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0028a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00551000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00554000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0028c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00558000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00559000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ea1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ea4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\System32\cmd.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2932 thread_handle: 0x000001ec process_identifier: 2928 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001e4	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0007d800', u'virtual_address': u'0x00002000', u'entropy': 7.9667453636679, u'name': u'.text', u'virtual_size': u'0x0007d6ec'}

entropy

7.96674536367

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00002c00', u'virtual_address': u'0x00080000', u'entropy': 7.6989330742905, u'name': u'.rsrc', u'virtual_size': u'0x00002bb4'}

entropy

7.69893307429

description

A section with a high entropy has been found

entropy

0.999026290166

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 7, 2023, 7:03 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://microsoft.com/

Yara rule detected in process memory (38 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	File Downloader	rule	Network_Downloader
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Run a KeyLogger	rule	KeyLogger
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	File Downloader	rule	Network_Downloader
description	Install itself for autorun at Windows startup	rule	Persistence
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	Run a KeyLogger	rule	KeyLogger

Terminates another process (4 events)

Time & API	Arguments	Status
NtTerminateProcess Nov. 7, 2023, 7:03 p.m.	status_code: 0xffffffff process_identifier: 2768 process_handle: 0x00000258
NtTerminateProcess Nov. 7, 2023, 7:03 p.m.	status_code: 0xffffffff process_identifier: 2768 process_handle: 0x00000258	1
NtTerminateProcess Nov. 7, 2023, 7:03 p.m.	status_code: 0xffffffff process_identifier: 2804 process_handle: 0x00000264
NtTerminateProcess Nov. 7, 2023, 7:03 p.m.	status_code: 0xffffffff process_identifier: 2804 process_handle: 0x00000264	1

Communicates with host for which no DNS query was performed (1 event)

host

155.94.136.130

Allocates execute permission to another process indicative of possible code injection (6 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2508 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2768 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244		3221225496
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2804 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c		3221225496
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2840 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000260	1	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f4	1	0
NtProtectVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02050000 process_handle: 0x000001f4	1	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images

reg_value

C:\Users\test22\Documents\images.exe

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2632 manipulating memory of non-child process 2768
Process injection	Process 2632 manipulating memory of non-child process 2804
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2768 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	3221225496	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2804 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c	3221225496	0

Potential code injection by writing to the memory of another process (10 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @$@8@G@V@e@t@@¸@Ú@ü@/@E@g@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(`B`BUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAd base_address: 0x00420000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: 2dq)êYÔ§ 5Gpü zïú·.ÈÉïÎx{ qx:f ëÁRO+e,ÖHe®é~ýÑÊ;æ>ò'Íÿá·Zß¨K¤é-Q¦ÿÖr²çª5± aQàOEÄ&T:³,Üh¡V\%»½¢ïZÎñtRæø÷9&@éX9Cm8<¯¡¾£µVI·æ{é\óMçV=&ðÄ« base_address: 0x0055b000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @$@8@G@V@e@t@@¸@Ú@ü@/@E@g@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(`B`BUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAd base_address: 0x00420000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: 2dq)êYÔ§ 5Gpü zïú·.ÈÉïÎx{ qx:f ëÁRO+e,ÖHe®é~ýÑÊ;æ>ò'Íÿá·Zß¨K¤é-Q¦ÿÖr²çª5± aQàOEÄ&T:³,Üh¡V\%»½¢ïZÎñtRæø÷9&@éX9Cm8<¯¡¾£µVI·æ{é\óMçV=&ðÄ« base_address: 0x0055b000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: UìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAdÅ¸Ë base_address: 0x02050000 process_identifier: 2928 process_handle: 0x000001f4	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: C:\Users\test22\Documents\images.exe¤ï/èè<ð/,<ð/P,Zu\|,Zu;¨èÄð/,$igÿÿÿÿÿäï/Èð/ø/à^\uÿÛþÿÿÿ\|,Zu 5Zuè base_address: 0x02060000 process_identifier: 2928 process_handle: 0x000001f4	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 2508 process_handle: 0x00000244	1	1	0
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 2840 process_handle: 0x00000260	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 632 called NtSetContextThread to modify thread in remote process 2508
Process injection	Process 2632 called NtSetContextThread to modify thread in remote process 2840
NtSetContextThread Nov. 7, 2023, 7:03 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4220830 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000240 process_identifier: 2508	1	0	0
NtSetContextThread Nov. 7, 2023, 7:03 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4220830 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2840	1	0	0

Attempts to remove evidence of file being downloaded from the Internet (2 events)

file	C:\Users\test22\AppData\Local\Temp\a.exe:Zone.Identifier
file	C:\Users\test22\Documents\images.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 632 resumed a thread in remote process 2508
Process injection	Process 2632 resumed a thread in remote process 2840
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2508	1	0	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2840	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 52 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 632	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 632	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 632	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 632	1	0
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 632	1	0
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 632	1	0
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2512 thread_handle: 0x00000240 process_identifier: 2508 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\a.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\a.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000244	1	1
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000240	1	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2508 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x00401000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x0041a000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @$@8@G@V@e@t@@¸@Ú@ü@/@E@g@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(`B`BUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAd base_address: 0x00420000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x00556000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x00559000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: 2dq)êYÔ§ 5Gpü zïú·.ÈÉïÎx{ qx:f ëÁRO+e,ÖHe®é~ýÑÊ;æ>ò'Íÿá·Zß¨K¤é-Q¦ÿÖr²çª5± aQàOEÄ&T:³,Üh¡V\%»½¢ïZÎñtRæø÷9&@éX9Cm8<¯¡¾£µVI·æ{é\óMçV=&ðÄ« base_address: 0x0055b000 process_identifier: 2508 process_handle: 0x00000244	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2508 process_handle: 0x00000244	1	1
NtSetContextThread Nov. 7, 2023, 7:03 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4220830 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000240 process_identifier: 2508	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2508	1	0
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2636 thread_handle: 0x000001f8 process_identifier: 2632 current_directory: filepath: C:\Users\test22\Documents\images.exe track: 1 command_line: filepath_r: C:\Users\test22\Documents\images.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001fc	1	1
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2632	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2632	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2632	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2632	1	0
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2772 thread_handle: 0x00000240 process_identifier: 2768 current_directory: filepath: C:\Users\test22\Documents\images.exe track: 1 command_line: filepath_r: C:\Users\test22\Documents\images.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000244	1	1
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000240	1	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2768 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244		3221225496
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2808 thread_handle: 0x00000258 process_identifier: 2804 current_directory: filepath: C:\Users\test22\Documents\images.exe track: 1 command_line: filepath_r: C:\Users\test22\Documents\images.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000025c	1	1
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000258	1	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2804 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c		3221225496
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2844 thread_handle: 0x00000264 process_identifier: 2840 current_directory: filepath: C:\Users\test22\Documents\images.exe track: 1 command_line: filepath_r: C:\Users\test22\Documents\images.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000260	1	1
NtGetContextThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000264	1	0
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2840 region_size: 1425408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000260	1	0
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÉWdE¨97E¨97E¨97§f7D¨97QÃ>6D¨97§d7G¨97QÃ=6F¨97bnT7D¨97bnW7@¨97@¤67A¨97QÃ?6D¨97QÃ86f¨97E¨87F©97ÄÑ06Â¨97ÄÑÆ7D¨97ÄÑ;6D¨97RichE¨97PEL±dàêg @À@Ýh`p,T@Û .textÛ `.rdataS T@@.data¸Qè@À.rsrcp,`.î@@.relocT@B.bss°2@@ base_address: 0x00400000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x00401000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x0041a000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @$@8@G@V@e@t@@¸@Ú@ü@/@E@g@TÍ<¨K¢`Ý;UBÄôK A³ÝJpMÛ(`B`BUìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAd base_address: 0x00420000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x00556000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: base_address: 0x00559000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: 2dq)êYÔ§ 5Gpü zïú·.ÈÉïÎx{ qx:f ëÁRO+e,ÖHe®é~ýÑÊ;æ>ò'Íÿá·Zß¨K¤é-Q¦ÿÖr²çª5± aQàOEÄ&T:³,Üh¡V\%»½¢ïZÎñtRæø÷9&@éX9Cm8<¯¡¾£µVI·æ{é\óMçV=&ðÄ« base_address: 0x0055b000 process_identifier: 2840 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2840 process_handle: 0x00000260	1	1
NtSetContextThread Nov. 7, 2023, 7:03 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4220830 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2840	1	0
NtResumeThread Nov. 7, 2023, 7:03 p.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2840	1	0
CreateProcessInternalW Nov. 7, 2023, 7:03 p.m.	thread_identifier: 2932 thread_handle: 0x000001ec process_identifier: 2928 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001e4	1	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:03 p.m.	process_identifier: 2928 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001f4	1	0
WriteProcessMemory Nov. 7, 2023, 7:03 p.m.	buffer: UìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃÈÒAdÅ¸Ë base_address: 0x02050000 process_identifier: 2928 process_handle: 0x000001f4	1	1

a.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All