Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 28, 2024, 9:24 a.m.	May 28, 2024, 9:26 a.m.

Size	3.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`70ab645e72548443cea20ffd8005dc1a`
SHA256	`0d201c707970f939a33dadfd8ae86aa6070db1f63dbed7c386b449f8fd06f0ce`
CRC32	`F436950A`
ssdeep	`98304:GadRn8oN6iuj0+rWH+gn4THiBqde4+IWgeXmN8Ec:GIRnNxe0+rC+RTH9k40vic`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library MALWARE_Win_VT_RedLine - Detects RedLine infostealer UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

STHealthClient.exe "C:\Users\test22\AppData\Local\Temp\STHealthClient.exe"
2568

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
47.104.173.216	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 47.104.173.216:8081	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 47.104.173.216:8081 -> 192.168.56.101:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 47.104.173.216:8081 -> 192.168.56.101:49162	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 47.104.173.216:8081 -> 192.168.56.101:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 26, 2024, 8:49 p.m.			0	0
IsDebuggerPresent May 26, 2024, 8:49 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c22710 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c22710 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c22750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c22750 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c22790 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c22790 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 26, 2024, 8:49 p.m.		1	1	0

One or more processes crashed (50 out of 934 events)

Time & API	Arguments	Status
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: sthealthclient+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4367324 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 4	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29770	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29738	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29706	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29674	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29642	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29610	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29578	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29546	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29514	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29482	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29450	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29418	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29386	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29354	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29322	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29290	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29258	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29226	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29194	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29162	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29130	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29098	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29066	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29034	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 29002	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28970	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28938	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28906	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28874	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28842	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28810	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28778	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28746	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28714	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28682	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28650	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28618	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28586	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28554	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28522	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28490	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28458	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28426	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28394	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28362	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4554720 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28330	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4558816 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28298	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4562912 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28266	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: STHealthClient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4567008 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 98 registers.ebx: 0 registers.esi: 36372512 registers.ecx: 28234	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02edb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735d4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02edc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06221000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\STHealthUpdate.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\STHealthUpdate.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 26, 2024, 8:49 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x003a7c00', u'virtual_address': u'0x00026000', u'entropy': 7.999369341296386, u'name': u'.rsrc', u'virtual_size': u'0x003a7ab0'}

entropy

7.9993693413

description

A section with a high entropy has been found

entropy

0.965188241362

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 26, 2024, 8:49 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

47.104.173.216

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 26, 2024, 8:49 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

STHealthClient.exe tried to sleep 2728224 seconds, actually delayed analysis time by 2728224 seconds

Generates some ICMP traffic

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.wc
ALYac	Trojan.GenericKD.72888937
Cylance	unsafe
VIPRE	Trojan.GenericKD.72888937
Sangfor	Trojan.Win32.Save.a
BitDefender	Trojan.GenericKD.72888937
Arcabit	Trojan.Generic.D4583269
VirIT	Trojan.Win32.Genus.VUC
Symantec	Trojan.Gen.MBT
tehtris	Generic.Malware
APEX	Malicious
McAfee	Artemis!70AB645E7254
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
MicroWorld-eScan	Trojan.GenericKD.72888937
Rising	Trojan.Generic@AI.100 (RDML:2VI0exocj95S9xCRAvWlyg)
Emsisoft	Trojan.GenericKD.72888937 (B)
TrendMicro	TrojanSpy.Win32.REDLINE.YXEEZZ
McAfeeD	ti!0D201C707970
FireEye	Generic.mg.70ab645e72548443
Sophos	Mal/Generic-S
MAX	malware (ai score=86)
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win32.Crypt.sa
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.72888937
AhnLab-V3	Trojan/Win.Generic.C5626643
BitDefenderTheta	Gen:NN.ZexaF.36804.Yt0@ayF0A3e
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.Stealer
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEEZZ
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.1728101.susgen
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)

STHealthClient.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All