popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

STHealthUpload.exe

RedLine Infostealer UltraVNC Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 28, 2024, 10:44 a.m. May 28, 2024, 10:55 a.m.
Size 272.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 26c7da49199c31fcfe179cee64b89116
SHA256 fd2f5c84d784904d78b6aee2d3c7762de5a58ddd0b4e371b752f9999f765320d
CRC32 5FD780F2
ssdeep 6144:+DKW1Lgbdl0TBBvjc/nyAMd35caMALhIO/kPu5X1kD:Yh1Lk70TnvjcqAg35mgWDPuW
PDB Path
Yara
  • Malicious_Library_Zero - Malicious_Library
  • MALWARE_Win_VT_RedLine - Detects RedLine infostealer
  • UltraVNC_Zero - UltraVNC
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063eb48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0063ec58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00647798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00647798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00647858
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00647798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: sthealthupload+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4367324
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 4
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4370400
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 917
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4374496
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 885
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4378592
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 853
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4382688
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 821
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4386784
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 789
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4390880
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 757
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4394976
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 725
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4399072
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 693
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4403168
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 661
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4407264
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 629
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4411360
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 597
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4415456
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 565
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4419552
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 533
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4423648
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 501
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4427744
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 469
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4431840
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 437
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4435936
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 405
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4440032
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 373
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4444128
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 341
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4448224
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 309
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4452320
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 277
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4456416
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 245
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4460512
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 213
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4464608
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 181
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4468704
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 149
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4472800
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 117
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4476896
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 85
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4480992
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 53
1 0 0

__exception__

 stacktrace: 
sthealthupload+0xf054 @ 0x40f054
sthealthupload+0xf0a0 @ 0x40f0a0
sthealthupload+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: sthealthupload+0xeff0
exception.address: 0x40eff0
exception.module: STHealthUpload.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4485088
registers.eax: 4367328
registers.ebp: 1636944
registers.edx: 68
registers.ebx: 0
registers.esi: 31326280
registers.ecx: 21
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02140000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00580000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00580000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02060000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00581000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00582000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f3a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f3c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00583000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00584000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f6b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f67000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04890000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f65000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04891000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f56000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f57000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0489a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d84000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0489b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0489c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0489f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ce1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00586000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00022200', u'virtual_address': u'0x00026000', u'entropy': 7.846341566058285, u'name': u'.rsrc', u'virtual_size': u'0x00022010'} entropy 7.84634156606 description A section with a high entropy has been found
entropy 0.502762430939 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.dc
ALYac Trojan.GenericKD.72888671
Cylance unsafe
VIPRE Trojan.GenericKD.72888671
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Trojan.GenericKD.72888671
K7GW Riskware ( 00584baa1 )
Arcabit Trojan.Generic.D458315F
VirIT Trojan.Win32.Genus.VUC
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
APEX Malicious
McAfee Artemis!26C7DA49199C
Avast Win32:Malware-gen
Kaspersky UDS:DangerousObject.Multi.Generic
MicroWorld-eScan Trojan.GenericKD.72888671
Rising Trojan.Generic@AI.100 (RDML:1k+Cl3/tRct7nFp/N73TrQ)
Emsisoft Trojan.GenericKD.72888671 (B)
TrendMicro TrojanSpy.Win32.REDLINE.YXEE1Z
McAfeeD ti!FD2F5C84D784
Trapmine malicious.high.ml.score
FireEye Generic.mg.26c7da49199c31fc
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Spy
Webroot W32.Trojan.GenKD
Google Detected
MAX malware (ai score=85)
Kingsoft malware.kb.a.993
Gridinsoft Spy.Win32.Keylogger.sa
Microsoft Trojan:Win32/Phonzy.A!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.GenericKD.72888671
Varist W32/Trojan.DAN.gen!Eldorado
BitDefenderTheta Gen:NN.ZexaF.36804.rq0@aejl6bb
DeepInstinct MALICIOUS
Malwarebytes Spyware.Stealer
TrendMicro-HouseCall TrojanSpy.Win32.REDLINE.YXEE1Z
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat.RF
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_90% (D)