popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

STHealthUp.exe

RedLine Infostealer UltraVNC Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 28, 2024, 10:43 a.m. May 28, 2024, 10:53 a.m.
Size 257.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e78473bca17b8e1e7353570719b5ad0c
SHA256 f81de3b76d2e7f5166c6029cbd9918dcc6c8649bb0d9f869a76e141b3abca791
CRC32 BDE985D2
ssdeep 6144:WDKW1Lgbdl0TBBvjc/ZbIu2CZd/5E4Nwsxx0L9QqL8:Qh1Lk70TnvjcN2kVvDp
PDB Path
Yara
  • Malicious_Library_Zero - Malicious_Library
  • MALWARE_Win_VT_RedLine - Detects RedLine infostealer
  • UltraVNC_Zero - UltraVNC
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840b00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840b40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840b40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840c00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840c00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840c00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840c00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840c00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840d00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840d00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840d00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00840d00
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: sthealthup+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4367324
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 4
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4370400
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 796
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4374496
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 764
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4378592
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 732
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4382688
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 700
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4386784
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 668
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4390880
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 636
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4394976
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 604
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4399072
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 572
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4403168
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 540
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4407264
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 508
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4411360
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 476
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4415456
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 444
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4419552
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 412
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4423648
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 380
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4427744
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 348
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4431840
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 316
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4435936
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 284
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4440032
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 252
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4444128
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 220
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4448224
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 188
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4452320
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 156
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4456416
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 124
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4460512
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 92
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4464608
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 60
1 0 0

__exception__

 stacktrace: 
sthealthup+0xf054 @ 0x40f054
sthealthup+0xf0a0 @ 0x40f0a0
sthealthup+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthup+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUp.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4468704
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 6
registers.ebx: 0
registers.esi: 32440392
registers.ecx: 28
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00370000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d4b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d45000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02341000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0234a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d36000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d3a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d37000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d2a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0234b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d84000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0234c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05090000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05091000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05094000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05095000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0001e400', u'virtual_address': u'0x00026000', u'entropy': 7.819636407050907, u'name': u'.rsrc', u'virtual_size': u'0x0001e334'} entropy 7.81963640705 description A section with a high entropy has been found
entropy 0.47265625 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
tehtris Generic.Malware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.dc
ALYac Trojan.GenericKD.72889114
Cylance unsafe
Sangfor Trojan.Win32.Save.a
BitDefender Trojan.GenericKD.72889114
Arcabit Trojan.Generic.D458331A
VirIT Trojan.Win32.Genus.VUC
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Avast Win32:Malware-gen
Kaspersky UDS:DangerousObject.Multi.Generic
MicroWorld-eScan Trojan.GenericKD.72889114
Rising Trojan.Generic@AI.100 (RDML:xawBdyj5MKbfWGjkKSB5EQ)
Emsisoft Trojan.GenericKD.72889114 (B)
BitDefenderTheta Gen:NN.ZexaF.36804.qq0@aOEh66g
TrendMicro TrojanSpy.Win32.REDLINE.YXEEZZ
McAfeeD ti!F81DE3B76D2E
Trapmine malicious.high.ml.score
FireEye Generic.mg.e78473bca17b8e1e
Sophos Mal/Generic-S
Webroot W32.Trojan.GenKD
Google Detected
MAX malware (ai score=83)
Kingsoft malware.kb.a.988
Gridinsoft Trojan.Win32.Agent.sa
Microsoft Trojan:Win32/Phonzy.A!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.GenericKD.72889114
Varist W32/Trojan.DAN.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.C5626645
McAfee Artemis!E78473BCA17B
DeepInstinct MALICIOUS
Malwarebytes Spyware.Stealer
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win32.REDLINE.YXEEZZ
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W32/PossibleThreat
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_70% (W)