popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Zocymkpxeu.exe

Socket Escalate priviledges Create Service DNS persistence PWS PE64 AntiDebug PE File URL Format AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Dec. 11, 2023, 3:20 p.m. Dec. 11, 2023, 3:22 p.m.
Size 2.7MB
Type PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5 b9922787936c8e2ed028b5bd652d7ee9
SHA256 81e40438564d00d8bf54950f87cae5122133b976e50f38b263f34c6e8e114288
CRC32 DA10101A
ssdeep 49152:emzyL4NGScXJXMUVgCxY+DPWCPKvf43iA8mM4uutdyhNcG7F50lbJi:AtSc5MwCKHuUpG7F5e9i
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
connv2.proxies.tv
A 51.79.32.112
51.79.32.112
bing.com
A 204.79.197.200
A 13.107.21.200
13.107.21.200
conn.pandaking2016.xyz
A 198.23.233.111
198.23.233.111
ip.allproxy.io
A 172.67.159.225
A 104.21.58.128
104.21.58.128
IP Address Status Action
164.124.101.2 Active Moloch
172.67.159.225 Active Moloch
198.23.233.111 Active Moloch
51.79.32.112 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49175 -> 172.67.159.225:80 2024897 ET USER_AGENTS Go HTTP Client User-Agent Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49173
51.79.32.112:9082 		None None None
TLS 1.3
192.168.56.103:49168
51.79.32.112:9082 		None None None
TLS 1.3
192.168.56.103:49178
172.67.159.225:443 		None None None
TLS 1.3
192.168.56.103:49176
51.79.32.112:9082 		None None None
TLS 1.3
192.168.56.103:49169
51.79.32.112:9082 		None None None
TLS 1.3
192.168.56.103:49174
51.79.32.112:9082 		None None None
TLS 1.3
192.168.56.103:49177
51.79.32.112:9082 		None None None
TLS 1.3
192.168.56.103:49179
51.79.32.112:9082 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000425ef0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000425ef0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000425ef0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000426120
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000426120
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000426120
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000046f7c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000046f7c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000046f7c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://ip.allproxy.io/json
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000008d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3c6b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000028a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35d4000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e5c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93efc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f26000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e4b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e6b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e9c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e6d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e42000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e5d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e5e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f75000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f77000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f79000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
section {u'size_of_data': u'0x002b5200', u'virtual_address': u'0x00002000', u'entropy': 7.998236835124485, u'name': u'.text', u'virtual_size': u'0x002b5158'} entropy 7.99823683512 description A section with a high entropy has been found
entropy 0.9994592646 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url https://github.com/quic-go/quic-go/wiki/Loggingx509:
url https://github.com/quic-go/quic-go/wiki/UDP-Receive-Buffer-Size
url https://allproxy.ioQueryPerformanceFrequency
url http://invalidlookup
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Install itself for autorun at Windows startup rule Persistence
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2456
region_size: 6717440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000250
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Bwqzg reg_value C:\Users\test22\AppData\Roaming\Bwqzg.exe
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\provisionshare.url
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ‹@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†D`ð" „.ä ]@€f` e| eÊÏ@¡[@.text˜‚.„. `.rdatapþ, .-Š.@@.data€í  [äŠ[@À.idata|en_@À.relocÊÏ eÐt_@B.symtabpfD`B
base_address: 0x0000000000400000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer: <“e(e@¡[kernel32.dllWriteFileWriteConsoleWWaitForMultipleObjectsWaitForSingleObjectVirtualQueryVirtualFreeVirtualAllocSwitchToThreadSuspendThreadSetWaitableTimerSetUnhandledExceptionFilterSetProcessPriorityBoostSetEventSetErrorModeSetConsoleCtrlHandlerResumeThreadPostQueuedCompletionStatusLoadLibraryALoadLibraryWSetThreadContextGetThreadContextGetSystemInfoGetSystemDirectoryAGetStdHandleGetQueuedCompletionStatusExGetProcessAffinityMaskGetProcAddressGetEnvironmentStringsWGetConsoleModeFreeEnvironmentStringsWExitProcessDuplicateHandleCreateWaitableTimerExWCreateThreadCreateIoCompletionPortCreateFileACreateEventACloseHandleAddVectoredExceptionHandler6eBeRele‚e’e e°eeҐeæe‘e‘e*‘e:‘eR‘eb‘e€‘e‘e ‘e´‘eȑeؑeî‘eþ‘e’e6’eH’eb’et’eŽ’eœ’e®’eȒeؒeò’e“e“e“e
base_address: 0x0000000000a59000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer: 
base_address: 0x0000000000a67000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffdb010
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ‹@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†D`ð" „.ä ]@€f` e| eÊÏ@¡[@.text˜‚.„. `.rdatapþ, .-Š.@@.data€í  [äŠ[@À.idata|en_@À.relocÊÏ eÐt_@B.symtabpfD`B
base_address: 0x0000000000400000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0
Process injection Process 156 called NtSetContextThread to modify thread in remote process 2456
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 4611488
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 2685704
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 2003748096
registers.rdx: 8796092870656
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000024c
process_identifier: 2456
1 0 0
Process injection Process 156 resumed a thread in remote process 2456
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000024c
suspend_count: 1
process_identifier: 2456
1 0 0
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000007fefe467a50
function_name: wine_get_version
module: ntdll
module_address: 0x00000000776c0000
-1073741511 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 156
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000134
suspend_count: 1
process_identifier: 156
1 0 0

NtResumeThread

 thread_handle: 0x000000000000017c
suspend_count: 1
process_identifier: 156
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001fc
suspend_count: 1
process_identifier: 156
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000c8
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000c8
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000c8
suspend_count: 1
process_identifier: 156
1 0 0

CreateProcessInternalW

 thread_identifier: 2460
thread_handle: 0x000000000000024c
process_identifier: 2456
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\Zocymkpxeu.exe
filepath_r:
stack_pivoted: 0
creation_flags: 12 (CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 1
process_handle: 0x0000000000000250
1 1 0

NtUnmapViewOfSection

 base_address: 0x0000000000400000
region_size: 12058624
process_identifier: 2456
process_handle: 0x0000000000000250
-1073741799 0

NtAllocateVirtualMemory

 process_identifier: 2456
region_size: 6717440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000250
1 0 0

WriteProcessMemory

 buffer: MZÿÿ‹@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†D`ð" „.ä ]@€f` e| eÊÏ@¡[@.text˜‚.„. `.rdatapþ, .-Š.@@.data€í  [äŠ[@À.idata|en_@À.relocÊÏ eÐt_@B.symtabpfD`B
base_address: 0x0000000000400000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000401000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00000000006ea000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00000000009ba000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer: <“e(e@¡[kernel32.dllWriteFileWriteConsoleWWaitForMultipleObjectsWaitForSingleObjectVirtualQueryVirtualFreeVirtualAllocSwitchToThreadSuspendThreadSetWaitableTimerSetUnhandledExceptionFilterSetProcessPriorityBoostSetEventSetErrorModeSetConsoleCtrlHandlerResumeThreadPostQueuedCompletionStatusLoadLibraryALoadLibraryWSetThreadContextGetThreadContextGetSystemInfoGetSystemDirectoryAGetStdHandleGetQueuedCompletionStatusExGetProcessAffinityMaskGetProcAddressGetEnvironmentStringsWGetConsoleModeFreeEnvironmentStringsWExitProcessDuplicateHandleCreateWaitableTimerExWCreateThreadCreateIoCompletionPortCreateFileACreateEventACloseHandleAddVectoredExceptionHandler6eBeRele‚e’e e°eeҐeæe‘e‘e*‘e:‘eR‘eb‘e€‘e‘e ‘e´‘eȑeؑeî‘eþ‘e’e6’eH’eb’et’eŽ’eœ’e®’eȒeؒeò’e“e“e“e
base_address: 0x0000000000a59000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000000a5a000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

WriteProcessMemory

 buffer: 
base_address: 0x0000000000a67000
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

NtGetContextThread

 thread_handle: 0x000000000000024c
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffdb010
process_identifier: 2456
process_handle: 0x0000000000000250
1 1 0

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 4611488
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 2685704
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 2003748096
registers.rdx: 8796092870656
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000024c
process_identifier: 2456
1 0 0

NtResumeThread

 thread_handle: 0x000000000000024c
suspend_count: 1
process_identifier: 2456
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000098
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000098
suspend_count: 1
process_identifier: 2456
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000d4
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000d4
suspend_count: 1
process_identifier: 2456
1 0 0

NtGetContextThread

 thread_handle: 0x0000000000000178
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2456
1 0 0
Bkav W64.AIDetectMalware.CS
Lionic Trojan.Win32.Seraph.a!c
MicroWorld-eScan Trojan.GenericKD.70714796
Skyhigh BehavesLike.Win64.Generic.vc
Cylance unsafe
VIPRE Trojan.GenericKD.70714796
Sangfor Downloader.Msil.Seraph.Vzi7
Alibaba TrojanDownloader:MSIL/Seraph.46bf4a50
Cybereason malicious.920950
Arcabit Trojan.Generic.D43705AC
VirIT Trojan.Win64.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Generik.BYNXTQW
APEX Malicious
Kaspersky HEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefender Trojan.GenericKD.70714796
Avast Win64:PWSX-gen [Trj]
Tencent Msil.Trojan-Downloader.Seraph.Fajl
Emsisoft Trojan.GenericKD.70714796 (B)
F-Secure Trojan.TR/AD.Nekark.dwlft
DrWeb Trojan.InjectNET.63
Trapmine suspicious.low.ml.score
FireEye Trojan.GenericKD.70714796
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Krypt
Google Detected
Avira TR/AD.Nekark.dwlft
Varist W64/ABRisk.ETST-2443
Kingsoft MSIL.Trojan-Downloader.Seraph.gen
Gridinsoft Ransom.Win64.Wacatac.sa
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ViRobot Trojan.Win.Z.Wacatac.2841088
ZoneAlarm HEUR:Trojan-Downloader.MSIL.Seraph.gen
GData Win64.Trojan.Agent.5QVRFF
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C5383650
ALYac Trojan.GenericKD.70714796
MAX malware (ai score=84)
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H0CL823
Rising Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:lO8671GQXfNlTDKkSBWQ+A)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat
AVG Win64:PWSX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)
dead_host 192.168.56.103:49193
dead_host 192.168.56.103:49181
dead_host 192.168.56.103:49190
dead_host 192.168.56.103:49186
dead_host 192.168.56.103:49167
dead_host 192.168.56.103:49170
dead_host 192.168.56.103:49191
dead_host 192.168.56.103:49194
dead_host 192.168.56.103:49182
dead_host 192.168.56.103:49187
dead_host 192.168.56.103:49171
dead_host 192.168.56.103:49188
dead_host 192.168.56.103:49195
dead_host 192.168.56.103:49183
dead_host 192.168.56.103:49184
dead_host 192.168.56.103:49172
dead_host 198.23.233.111:29082
dead_host 192.168.56.103:49189
dead_host 192.168.56.103:49192
dead_host 192.168.56.103:49180
dead_host 192.168.56.103:49185