Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 6, 2024, 10:30 a.m.	Jan. 6, 2024, 10:34 a.m.

Size	4.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`fabf8dca1b11532b560d638e85d67110`
SHA256	`675eae5e18d018109f42efb7c76c9ac83af9ffd9e010d39acbb6a12450d6d1eb`
CRC32	`0E891C02`
ssdeep	`49152:MB0T5eLWY4IoG8UKkP6beyAMKN573OIYoA5SMNnMC0G59:MMIeU7P+TAM8LOdp9Nn50U9`
PDB Path	a_collection_of_necessary_programs_for_use.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

bakhtiar.exe "C:\Users\test22\AppData\Local\Temp\bakhtiar.exe"
1156
- InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2532

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 6, 2024, 10:30 a.m.			0	0
IsDebuggerPresent Jan. 6, 2024, 10:30 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 6, 2024, 10:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e1a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 6, 2024, 10:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e1a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 6, 2024, 10:31 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e1ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

a_collection_of_necessary_programs_for_use.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 6, 2024, 10:30 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 51 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02400000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:30 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00601000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00602000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a6f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00603000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00604000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00605000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 1156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\Protect544cd51a.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Protect544cd51a.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0045c600', u'virtual_address': u'0x00002000', u'entropy': 7.164823716903257, u'name': u'.text', u'virtual_size': u'0x0045c414'}

entropy

7.1648237169

description

A section with a high entropy has been found

entropy

0.968445022772

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 2441a44b06509975255deafbaa7fd57a83a0bd41
buffer	Buffer with sha1: 9416c41c986222310b907d751fa06e5e5233f918

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 2532 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a4	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL?Õeà(úð@`@duP d¾ôu@.textn&( `.rdata7@8,@@.data$d@À.relocd¾ Àf@B base_address: 0x00400000 process_identifier: 2532 process_handle: 0x000002a4	1	1	0
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2532 process_handle: 0x000002a4	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL?Õeà(úð@`@duP d¾ôu@.textn&( `.rdata7@8,@@.data$d@À.relocd¾ Àf@B base_address: 0x00400000 process_identifier: 2532 process_handle: 0x000002a4	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1156 called NtSetContextThread to modify thread in remote process 2532
NtSetContextThread Jan. 6, 2024, 10:31 a.m.	registers.eip: 2005598660 registers.esp: 3996980 registers.edi: 0 registers.eax: 4293360 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a0 process_identifier: 2532	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1156 resumed a thread in remote process 2532
NtResumeThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 2532	1	0	0

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread Jan. 6, 2024, 10:30 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1156	1	0
NtResumeThread Jan. 6, 2024, 10:30 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1156	1	0
NtResumeThread Jan. 6, 2024, 10:30 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 1156	1	0
NtResumeThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 1156	1	0
NtGetContextThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1156	1	0
NtGetContextThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1156	1	0
CreateProcessInternalW Jan. 6, 2024, 10:31 a.m.	thread_identifier: 2536 thread_handle: 0x000002a0 process_identifier: 2532 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe filepath_r: stack_pivoted: 0 creation_flags: 564 (CREATE_NEW_CONSOLE\|CREATE_NEW_PROCESS_GROUP\|CREATE_SUSPENDED\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000002a4	1	1
NtUnmapViewOfSection Jan. 6, 2024, 10:31 a.m.	base_address: 0x00400000 region_size: 1999372288 process_identifier: 2532 process_handle: 0x000002a4		3221225497
NtAllocateVirtualMemory Jan. 6, 2024, 10:31 a.m.	process_identifier: 2532 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a4	1	0
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL?Õeà(úð@`@duP d¾ôu@.textn&( `.rdata7@8,@@.data$d@À.relocd¾ Àf@B base_address: 0x00400000 process_identifier: 2532 process_handle: 0x000002a4	1	1
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: base_address: 0x00401000 process_identifier: 2532 process_handle: 0x000002a4	1	1
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: base_address: 0x00444000 process_identifier: 2532 process_handle: 0x000002a4	1	1
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: base_address: 0x00448000 process_identifier: 2532 process_handle: 0x000002a4	1	1
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: base_address: 0x0045a000 process_identifier: 2532 process_handle: 0x000002a4	1	1
NtGetContextThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000002a0	1	0
WriteProcessMemory Jan. 6, 2024, 10:31 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2532 process_handle: 0x000002a4	1	1
NtSetContextThread Jan. 6, 2024, 10:31 a.m.	registers.eip: 2005598660 registers.esp: 3996980 registers.edi: 0 registers.eax: 4293360 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002a0 process_identifier: 2532	1	0
NtResumeThread Jan. 6, 2024, 10:31 a.m.	thread_handle: 0x000002a0 suspend_count: 1 process_identifier: 2532	1	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Injuke.16!c
MicroWorld-eScan	Trojan.GenericKD.71083850
Skyhigh	Artemis!Trojan
McAfee	Artemis!FABF8DCA1B11
Cylance	unsafe
Sangfor	Trojan.Msil.Kryptik.Vk1a
K7AntiVirus	Trojan ( 005b01281 )
Alibaba	Trojan:MSIL/GenKryptik.c1208c23
K7GW	Trojan ( 005b01281 )
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GSFZ
Kaspersky	HEUR:Trojan.MSIL.Injuke.gen
BitDefender	Trojan.GenericKD.71083850
Avast	Win32:CrypterX-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Tgil
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.Nekark.sscjy
TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXEAEZ
Emsisoft	Trojan.GenericKD.71083850 (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.MSIL.Injuke
Google	Detected
Avira	TR/AD.Nekark.sscjy
Varist	W32/MSIL_Kryptik.KIT.gen!Eldorado
Antiy-AVL	Trojan/MSIL.GenKryptik
Kingsoft	MSIL.Trojan.Injuke.gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Ransom.Win32.Wacatac.sa
Arcabit	Trojan.Generic.D43CA74A
ZoneAlarm	HEUR:Trojan.MSIL.Injuke.gen
GData	Win32.Trojan.Agent.SGPR44
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.CrypterX-gen.C5570686
BitDefenderTheta	Gen:NN.ZemsilF.36680.@p2@amQCZsc
MAX	malware (ai score=82)
Malwarebytes	Trojan.Crypt.MSIL
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXEAEZ
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.AJDT!tr
AVG	Win32:CrypterX-gen [Trj]
DeepInstinct	MALICIOUS

bakhtiar.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All