popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bin.exe

Generic Malware .NET framework(MSIL) Malicious Library AntiDebug PE File DLL PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 1, 2024, 4:54 p.m. May 1, 2024, 4:56 p.m.
Size 690.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 4160db87b054d159be5eb8ee4cd27c38
SHA256 3911ca0a3ba01ed03c568bf9e8dba24af0a2d0c4cd05cc4d453d17729f2feace
CRC32 04C01DB8
ssdeep 12288:jPkB778Q4fgxzL/1q+ahzvjnBeaUYDVpxpiLG8ofzR+pY0L515MeMLDQe0u:LkBq4xf1q+qVfpiXuMpLBMLD7
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 203.161.62.199:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request POST http://www.thechurchinkaty.com/nrup/
request GET http://www.thechurchinkaty.com/nrup/?xaRt=a+HLDFsiIkHuV4rg7wup8csxdWPagIuMO9xbFOtVeNEzn7JMPDdWHI+uhZWQfHs/Ujvr+dR2RkWjKuppUanuG8WbeCSiVE7Ei81rIR6FZpKHS1/3Xety/MDmz3VaKjqLYqmj5Ic=&c18u_=M74HXBoKY4
request GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3370000.zip
request GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
request GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3150000.zip
request POST http://www.hggg2qyws.sbs/nrup/
request GET http://www.hggg2qyws.sbs/nrup/?xaRt=cxIeN1iVhQqOwsowvitnNvuwmm+qqrvfdqpS9UswCbkbA/58Vi1sucBg6AEQyfE3zCqKK/TeeNcUyXCS2fazATIsLYQU9UjmCyAW0hXXUGLfcbDiNK6ibWhgqHsNoHkz1gGc9BA=&c18u_=M74HXBoKY4
request POST http://www.297tamatest1kb.com/nrup/
request GET http://www.297tamatest1kb.com/nrup/?xaRt=aN7x9cBVxwix9wZx9HG3+EyfX6HqMCI/orbHVM7uweNeZbe3aghpRaSsJCdVU54yexiCzw7M43tjxUam+UkaT2wmXrLzq3RCnmrT+WsLWscIcK9ZkaiF0pmbsoq7wiXgkQMFFG4=&c18u_=M74HXBoKY4
request POST http://www.quirkyquotients.online/nrup/
request GET http://www.quirkyquotients.online/nrup/?xaRt=rSdoiViGYDYLrRKaJiLWx0o3GtWbUyMrBzK7mFXa25NHqewciJOPoSpxRDHHO+kRgCzM5kcGIwbMEKTHJRshE8TECWuxqnWE5XbWOupO3d188GRCRjny7znmim8cpOOWG3XQuQg=&c18u_=M74HXBoKY4
request POST http://www.zopter.dev/nrup/
request GET http://www.zopter.dev/nrup/?xaRt=i3HAzC/U9OJxIpd/cVIqioUroH7qJoGS67PrGCHTQB0skmoYQlANVfiIbPI4IH/9kWpHr7erIPqYDzJ48SYt+oJ/0g0iC6yZWX/8c4ct4DQ3d1iauYFK6CebNAulbWCgMaeXdHw=&c18u_=M74HXBoKY4
request POST http://www.gudvain.top/nrup/
request GET http://www.gudvain.top/nrup/?xaRt=SizHnN/9xgcqSIkRxdV/yLkuLlfb9ih/0t0LsappuxDuweYFtCvxWsRrJ8CRzXcbZvFBcd4a+abpRctwr4ssx6D/64ygBVY2l9ARrA+Cnd/k0rcrBh5k0YyNTI11ygD5K0ma9bo=&c18u_=M74HXBoKY4
request POST http://www.nimaster.com/nrup/
request GET http://www.nimaster.com/nrup/?xaRt=QRCJemSun6KfUPjbw7Wl+EOfwXHgZ1iyr2LzNdaeeYxuOQk1p7mHourK8lVarsbBIBvr9aHYFlgCj6gFp9RacDqO10qGjeH1kC54hh2O/YnQ/xfdeKLFPyrwmVjF+1gbpdrtHJA=&c18u_=M74HXBoKY4
request POST http://www.deniztemiz.fun/nrup/
request GET http://www.deniztemiz.fun/nrup/?xaRt=3O5z/vVa1aiBIg/20FYhZ9gN3gEIDgA4MhhTC4igeHW13Qm1DZfDyX2p9mwAZMK6YdFTnsLdJzS54TsXooWKxMFKzkTPzf0/wvcz0IEqhbvScFDLwEMJ7HljO9/d9GWeP3ZvlWk=&c18u_=M74HXBoKY4
request POST http://www.agoraeubebo.com/nrup/
request GET http://www.agoraeubebo.com/nrup/?xaRt=dWrD1PFadq7V5KkT+bFohqEZffGVUNdu4bG3e9Abb7XIEj/TR5WiVjbbrLaqi43PNcTkySoUuB0roTQbaYzLsbJy/Bzx6mO/iyMVNYumf/O/IEDIdi+XIYrNNSqPi1S0X8+SZl8=&c18u_=M74HXBoKY4
request POST http://www.thechurchinkaty.com/nrup/
request POST http://www.hggg2qyws.sbs/nrup/
request POST http://www.297tamatest1kb.com/nrup/
request POST http://www.quirkyquotients.online/nrup/
request POST http://www.zopter.dev/nrup/
request POST http://www.gudvain.top/nrup/
request POST http://www.nimaster.com/nrup/
request POST http://www.deniztemiz.fun/nrup/
request POST http://www.agoraeubebo.com/nrup/
domain www.gudvain.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00470000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00475000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00721000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00722000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00723000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00724000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00725000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00726000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0072c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0072d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a5f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0072e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0072f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003de000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a75000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a77000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2424
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02240000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
description finger.exe tried to sleep 154 seconds, actually delayed analysis time by 154 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\bin.exe
file C:\Users\test22\AppData\Local\Temp\bin.exe
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
section {u'size_of_data': u'0x000ab400', u'virtual_address': u'0x00002000', u'entropy': 7.9808394538246, u'name': u'.text', u'virtual_size': u'0x000ab0ac'} entropy 7.98083945382 description A section with a high entropy has been found
entropy 0.994194484761 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2424
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b8
1 0 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELŒœK]à  0@0@.textd  `
base_address: 0x00400000
process_identifier: 2424
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2424
process_handle: 0x000002b8
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELŒœK]à  0@0@.textd  `
base_address: 0x00400000
process_identifier: 2424
process_handle: 0x000002b8
1 1 0
Process injection Process 1372 called NtSetContextThread to modify thread in remote process 2424
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199696
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002b4
process_identifier: 2424
1 0 0
Process injection Process 1372 resumed a thread in remote process 2424
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002b4
suspend_count: 1
process_identifier: 2424
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1372
1 0 0

NtResumeThread

 thread_handle: 0x000002ac
suspend_count: 1
process_identifier: 1372
1 0 0

CreateProcessInternalW

 thread_identifier: 2428
thread_handle: 0x000002b4
process_identifier: 2424
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\bin.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\bin.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002b8
1 1 0

NtGetContextThread

 thread_handle: 0x000002b4
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2424
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002b8
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELŒœK]à  0@0@.textd  `
base_address: 0x00400000
process_identifier: 2424
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2424
process_handle: 0x000002b8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2424
process_handle: 0x000002b8
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199696
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002b4
process_identifier: 2424
1 0 0

NtResumeThread

 thread_handle: 0x000002b4
suspend_count: 1
process_identifier: 2424
1 0 0

NtResumeThread

 thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 2528
1 0 0

CreateProcessInternalW

 thread_identifier: 2748
thread_handle: 0x00000428
process_identifier: 2744
current_directory:
filepath: C:\Program Files\Mozilla Firefox\firefox.exe
track: 1
command_line:
filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe
stack_pivoted: 0
creation_flags: 12 (CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x00000434
1 1 0
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Taskun.4!c
Skyhigh BehavesLike.Win32.Generic.jc
ALYac Trojan.GenericKDZ.106473
Cylance unsafe
VIPRE Trojan.GenericKDZ.106473
Sangfor Suspicious.Win32.Save.a
BitDefender Trojan.GenericKDZ.106473
VirIT Trojan.Win32.MSIL_Heur.A
Symantec Scr.Malcode!gdn33
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Kryptik.ALMO
APEX Malicious
Avast Win32:RATX-gen [Trj]
Kaspersky HEUR:Trojan.MSIL.Taskun.gen
Alibaba Trojan:Application/Generic.f3029857
MicroWorld-eScan Trojan.GenericKDZ.106473
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:L81qNQtfB6kU2+GoR8Aqew)
Emsisoft Trojan.GenericKDZ.106473 (B)
F-Secure Trojan.TR/Kryptik.fgwyw
DrWeb Trojan.PackedNET.2511
Trapmine malicious.high.ml.score
FireEye Generic.mg.4160db87b054d159
Sophos Troj/Krypt-ABH
Ikarus Trojan.MSIL.Inject
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Kryptik.fgwyw
MAX malware (ai score=80)
Kingsoft MSIL.Trojan.Taskun.gen
Gridinsoft Trojan.Win32.Packed.sa
Xcitium Malware@#1fju3kji6m2me
Arcabit Trojan.Generic.D19FE9
ZoneAlarm HEUR:Trojan.MSIL.Taskun.gen
GData Trojan.GenericKDZ.106473
Varist W32/MSIL_Kryptik.KUK.gen!Eldorado
AhnLab-V3 Trojan/Win.MSILKrypt.R646598
BitDefenderTheta Gen:NN.ZemsilCO.36804.Rm0@aWLSxu
DeepInstinct MALICIOUS
Malwarebytes Trojan.MalPack.PNG.Generic
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R03BH0CDU24
Tencent Msil.Trojan.Taskun.Hdhl
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Nekark.TIYVL!tr
AVG Win32:RATX-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan:MSIL/Taskun.gyf