popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

HJC.exe

Emotet Malicious Library UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 19, 2024, 1:08 p.m. April 19, 2024, 1:11 p.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 29af19382bdeadee6d93b98f354e703d
SHA256 8a005601e52341e8aff3c95cf30f4ede6b874d2b7e6ffdb9afda9425733fc5d7
CRC32 1EFCA10B
ssdeep 49152:3ARQYxxZrm0UZu0LCi2wcc/Z9L7KtQDSxxZrmh7:3Uxu0UQ0LCccaZ9LU7xuh
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 13.107.137.11:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

No Suricata TLS

section .itext
packer BobSoft Mini Delphi -> BoB / BobSoft
resource name WAVE
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x34b7646
0x34b7679
0x34b7594
0x34ae454
0x34c0224
0x34c9b38
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x73933af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7393a535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7393a434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 345562660
registers.edi: 1
registers.eax: 345562660
registers.ebp: 345562740
registers.edx: 0
registers.ebx: 345564464
registers.esi: 344438352
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73662000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 568037428
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c608
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 568037428
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c608
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 568037428
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c608
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 568037428
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c608
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1385447420
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03505350
process_handle: 0xffffffff
3221225496 0
name WAVE language LANG_CHINESE filetype RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0013a20c size 0x00001006
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00199840 size 0x0000c524
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002228b0 size 0x00000022
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002228b0 size 0x00000022
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 167936
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x034a1000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000cb800', u'virtual_address': u'0x0005d000', u'entropy': 7.289546401619149, u'name': u'.data', u'virtual_size': u'0x000cb6a8'} entropy 7.28954640162 description A section with a high entropy has been found
section {u'size_of_data': u'0x000e9a00', u'virtual_address': u'0x00139000', u'entropy': 7.043309886796227, u'name': u'.rsrc', u'virtual_size': u'0x000e9a00'} entropy 7.0433098868 description A section with a high entropy has been found
entropy 0.814202561118 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000002dc
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
Process injection Process 2644 manipulating memory of non-child process 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 0
region_size: 288000000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x034a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000000
3221225480 0

NtAllocateVirtualMemory

 process_identifier: 0
region_size: 288000000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x034ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000000
3221225480 0

NtAllocateVirtualMemory

 process_identifier: 0
region_size: 288000000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x034cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000000
3221225480 0

NtAllocateVirtualMemory

 process_identifier: 0
region_size: 288000000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x03502000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000000
3221225480 0

NtAllocateVirtualMemory

 process_identifier: 0
region_size: 288000000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x03506000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000000
3221225480 0

NtAllocateVirtualMemory

 process_identifier: 0
region_size: 288000000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
base_address: 0x03508000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0x00000000
3221225480 0
Bkav W32.AIDetectMalware
Cynet Malicious (score: 99)
Cylance unsafe
Sangfor Downloader.Win32.Remcos.Vrn0
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Zusy.545470
Arcabit Trojan.Zusy.D852BE
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Win32/TrojanDownloader.ModiLoader.ACA
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
Alibaba TrojanDownloader:Win32/ModiLoader.d08e3914
MicroWorld-eScan Gen:Variant.Zusy.545470
Rising Downloader.Agent!1.EFE4 (CLASSIC)
Emsisoft Gen:Variant.Zusy.545470 (B)
F-Secure Trojan.TR/Redcap.pilcq
DrWeb Trojan.DownLoader46.58658
FireEye Gen:Variant.Zusy.545470
Sophos Mal/Generic-S
Ikarus Trojan-Spy.MetaStealer
Webroot W32.Trojan.TR.Redcap.pilcq
Google Detected
Avira TR/Redcap.pilcq
MAX malware (ai score=83)
Kingsoft Win32.Hack.Remcos.gen
Gridinsoft Trojan.Win32.Gen.tr
Microsoft Trojan:Win32/Remcos.TAP!MTB
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Win32.Malware.KillAV.ERW5U9@gen
Varist W32/Trojan.MEZZ-6538
AhnLab-V3 Trojan/Win.DelfInject.C5285045
DeepInstinct MALICIOUS
Malwarebytes Trojan.MalPack.DLF
Panda Trj/GdSda.A
Yandex Trojan.Igent.b17A9L.25
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/ModiLoader.YK!tr
AVG Win32:DropperX-gen [Drp]
alibabacloud Backdoor:Win/Remcos.gyf