Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 3, 2024, 1:40 p.m.	April 3, 2024, 1:45 p.m.

Size	5.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2dc9ceba069ad4540a8a5bd03b4b4f4d`
SHA256	`0d5dfa5333b6138322fb6cc306002fa5cc36db62576867856866bbd98031c43d`
CRC32	`2833F649`
ssdeep	`98304:pvzTUXYDZ6ZSyVsysRfmWXsEJxf6OaRB9Yep8ZqTxM8qlnkaTelzKRhFgZJxAMGI:SX0yVhsRtZnF2OdqVMhkWuzKjOZJ5AlK`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description)

getimage15.php "C:\Users\test22\AppData\Local\Temp\getimage15.php"
2540

Name	Response	Post-Analysis Lookup
ipinfo.io	A 34.117.186.192	34.117.186.192
db-ip.com	A 104.26.5.15 A 104.26.4.15 A 172.67.75.166	104.26.5.15

IP Address	Status	Action
172.67.75.166	Active	Moloch
164.124.101.2	Active	Moloch
34.117.186.192	Active	Moloch
5.42.65.117	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49165 -> 34.117.186.192:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49165 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49167 -> 172.67.75.166:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 5.42.65.117:50500	2049060	ET MALWARE RisePro TCP Heartbeat Packet	A Network Trojan was detected
TCP 5.42.65.117:50500 -> 192.168.56.101:49164	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	A Network Trojan was detected
TCP 192.168.56.101:49165 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49167 172.67.75.166:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=db-ip.com	65:b1:27:2e:35:d2:f7:1f:20:04:c5:ca:ea:4e:7a:b4:69:6a:83:00

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 3, 2024, 1:40 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	.vmp\xc3\xbc\xc3\x97
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ April 3, 2024, 1:40 p.m.	stacktrace: Start+0x4ad36a getimage15+0x513daa @ 0x8a3daa Start+0x496cce getimage15+0x4fd70e @ 0x88d70e exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 c4 c6 c9 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 2226488 registers.edi: 6004736 registers.eax: 2226488 registers.ebp: 2226568 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 1995994155 registers.ecx: 1612054528	1
__exception__ April 3, 2024, 1:40 p.m.	stacktrace: exception.instruction_r: ed e9 d0 9f fe ff c3 e9 de bc fc ff cb ed fc 04 exception.symbol: Start+0x504de2 getimage15+0x56b822 exception.instruction: in eax, dx exception.module: getimage15.php exception.exception_code: 0xc0000096 exception.offset: 5683234 exception.address: 0x8fb822 registers.esp: 2226608 registers.edi: 7609058 registers.eax: 1750617430 registers.ebp: 6004736 registers.edx: 24139862 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ April 3, 2024, 1:40 p.m.	stacktrace: exception.instruction_r: ed e9 98 4a 09 00 7d 36 97 3b 6c 19 00 00 e4 00 exception.symbol: Start+0x42053a getimage15+0x486f7a exception.instruction: in eax, dx exception.module: getimage15.php exception.exception_code: 0xc0000096 exception.offset: 4747130 exception.address: 0x816f7a registers.esp: 2226608 registers.edi: 7609058 registers.eax: 1447909480 registers.ebp: 6004736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

Performs some HTTP requests (1 event)

request

GET https://db-ip.com/demo/home.php?s=175.208.134.152

Allocates read-write-execute memory (usually to unpack itself) (50 out of 187 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f60000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7585f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75868000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7598b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7598b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75984000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755da000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7563e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755e5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755dc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7597c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75988000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75988000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ec000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75988000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c5000 process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ipinfo.io

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 3, 2024, 1:40 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02f20000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x005df400', u'virtual_address': u'0x009ec000', u'entropy': 7.991229198863169, u'name': u'.vmp\\xc3\\xbc\\xc3\\x97', u'virtual_size': u'0x005df350'}

entropy

7.99122919886

description

A section with a high entropy has been found

entropy

0.998505479907

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

The executable is likely packed with VMProtect (4 events)

section	.vmp\xc3\xbc\xc3\x97	description	Section name indicates VMProtect
section	.vmp\xc3\xbc\xc3\x97	description	Section name indicates VMProtect
section	.vmp\xc3\xbc\xc3\x97	description	Section name indicates VMProtect
section	.vmp\xc3\xbc\xc3\x97	description	Section name indicates VMProtect

Communicates with host for which no DNS query was performed (1 event)

host

5.42.65.117

Checks for the presence of known windows from debuggers and forensic tools (12 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA April 3, 2024, 1:40 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA April 3, 2024, 1:40 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 3, 2024, 1:40 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 3, 2024, 1:40 p.m.	stacktrace: exception.instruction_r: ed e9 98 4a 09 00 7d 36 97 3b 6c 19 00 00 e4 00 exception.symbol: Start+0x42053a getimage15+0x486f7a exception.instruction: in eax, dx exception.module: getimage15.php exception.exception_code: 0xc0000096 exception.offset: 4747130 exception.address: 0x816f7a registers.esp: 2226608 registers.edi: 7609058 registers.eax: 1447909480 registers.ebp: 6004736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.RisePro.i!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	Artemis
Cylance	unsafe
Sangfor	Infostealer.Win32.Agent.Vqaq
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.ADVG.gen
McAfee	Artemis!2DC9CEBA069A
Avast	FileRepMalware [Misc]
Kaspersky	Trojan-PSW.Win32.RisePro.khr
Rising	Trojan.Generic@AI.82 (RDML:sHWr2Fytn8ybIcGdE4SSdg)
F-Secure	Trojan.TR/AVI.Agent.hwiam
DrWeb	Trojan.DownLoader46.56461
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.2dc9ceba069ad454
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Agent
Google	Detected
Avira	TR/AVI.Agent.hwiam
Antiy-AVL	Trojan/Win32.Sabsik
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win32.RisePro.mz!c
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	Trojan-PSW.Win32.RisePro.khr
GData	Win32.Trojan-Stealer.RisePro.IATQJI
AhnLab-V3	Suspicious/Win.MalPe.X2205
BitDefenderTheta	Gen:NN.ZexaF.36802.@7Z@aiF5Q1l
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.3613714141
Panda	Trj/Chgt.AD
Tencent	Win32.Trojan-QQPass.QQRob.Cdhl
Fortinet	W32/Agent.ADVG!tr
AVG	FileRepMalware [Misc]
CrowdStrike	win/malicious_confidence_100% (W)

getimage15.php

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All