Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 31, 2024, 10:03 a.m.	May 31, 2024, 10:21 a.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`85d6cf6654492780b26bb9ed64ae24ab`
SHA256	`7a0b0fb9ea0009a2533df194555b6a13767e9f9f860276da5cc59d119c61ab75`
CRC32	`0320FC52`
ssdeep	`49152:0d+n2BsqGNvDL6iGEwr4lHnuSVExpJuSipXyzgz0x0MBo8xK:0nH2KiGvGHuywJuHlyDBk`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
1488
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
  2620
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
  2688

Name	Response	Post-Analysis Lookup
ipinfo.io	A 34.117.186.192	34.117.186.192
www.maxmind.com	A 104.17.27.25 A 104.17.28.25	104.17.28.25
db-ip.com	A 104.26.5.15 A 104.26.4.15 A 172.67.75.166	104.26.5.15

IP Address	Status	Action
104.17.28.25	Active	Moloch
104.26.4.15	Active	Moloch
147.45.47.126	Active	Moloch
164.124.101.2	Active	Moloch
34.117.186.192	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 147.45.47.126:58709 -> 192.168.56.103:49165	2400022	ET DROP Spamhaus DROP Listed Traffic Inbound group 23	Misc Attack
TCP 192.168.56.103:49165 -> 147.45.47.126:58709	2049060	ET MALWARE RisePro TCP Heartbeat Packet	A Network Trojan was detected
TCP 147.45.47.126:58709 -> 192.168.56.103:49165	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 104.26.4.15:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49168 104.26.4.15:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=db-ip.com	1f:af:15:cd:f8:f8:ee:30:f9:6e:6e:54:bc:9a:a7:c7:77:70:6d:25

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW May 31, 2024, 10:03 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW May 31, 2024, 10:03 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (15 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 31, 2024, 10:02 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:02 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:02 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:02 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:02 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:02 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0
IsDebuggerPresent May 31, 2024, 10:03 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 31, 2024, 10:03 a.m.	buffer: SUCCESS: The scheduled task "MPGPH131 HR" has successfully been created. console_handle: 0x00000007	1	1	0
WriteConsoleW May 31, 2024, 10:03 a.m.	buffer: SUCCESS: The scheduled task "MPGPH131 LG" has successfully been created. console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	\x00
section	.idata
section
section	emrtqrcy
section	uyiuxbae
section	.taggant

One or more processes crashed (50 out of 126 events)

Time & API	Arguments	Status
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: random+0x44b0b9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 4501689 exception.address: 0x116b0b9 registers.esp: 1439944 registers.edi: 0 registers.eax: 1 registers.ebp: 1439960 registers.edx: 19972096 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 26 02 00 00 81 f1 02 e2 5e ac 31 cb e9 9f exception.symbol: random+0x18f41c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1635356 exception.address: 0xeaf41c registers.esp: 1439908 registers.edi: 1971192040 registers.eax: 28154 registers.ebp: 4005416980 registers.edx: 15396300 registers.ebx: 1971192040 registers.esi: 3 registers.ecx: 1971388416	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 31 db 50 68 35 f4 51 2c e9 ee 01 00 00 b9 01 exception.symbol: random+0x18f233 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1634867 exception.address: 0xeaf233 registers.esp: 1439912 registers.edi: 1971192040 registers.eax: 28154 registers.ebp: 4005416980 registers.edx: 15424454 registers.ebx: 1971192040 registers.esi: 3 registers.ecx: 1971388416	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 ee fe ff ff 89 14 24 ba b5 7d ff 7f e9 00 exception.symbol: random+0x18f74d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1636173 exception.address: 0xeaf74d registers.esp: 1439912 registers.edi: 1971192040 registers.eax: 28154 registers.ebp: 4005416980 registers.edx: 15424454 registers.ebx: 4294941784 registers.esi: 683698262 registers.ecx: 1971388416	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 29 c0 ff 34 10 ff 34 24 e9 bf 05 00 00 57 bf exception.symbol: random+0x18fcfd exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1637629 exception.address: 0xeafcfd registers.esp: 1439912 registers.edi: 1971192040 registers.eax: 29417 registers.ebp: 4005416980 registers.edx: 15428744 registers.ebx: 4294941784 registers.esi: 683698262 registers.ecx: 1056171858	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 52 81 ec 04 00 00 00 89 0c 24 e9 57 06 00 00 exception.symbol: random+0x18fb1e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1637150 exception.address: 0xeafb1e registers.esp: 1439912 registers.edi: 1971192040 registers.eax: 4294940316 registers.ebp: 4005416980 registers.edx: 15428744 registers.ebx: 4294941784 registers.esi: 683698262 registers.ecx: 236777	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 56 89 3c 24 e9 22 03 00 00 8b 24 24 56 8b 2c exception.symbol: random+0x307610 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3175952 exception.address: 0x1027610 registers.esp: 1439912 registers.edi: 16969301 registers.eax: 31665 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 58327930 registers.esi: 16920826 registers.ecx: 890	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 68 b1 d9 19 3e 89 0c 24 e9 00 00 00 00 89 34 exception.symbol: random+0x307d9b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3177883 exception.address: 0x1027d9b registers.esp: 1439912 registers.edi: 16940577 registers.eax: 31665 registers.ebp: 4005416980 registers.edx: 663785 registers.ebx: 58327930 registers.esi: 16920826 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 1b 04 00 00 8b 04 24 81 c4 04 00 00 00 e9 exception.symbol: random+0x308fcc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3182540 exception.address: 0x1028fcc registers.esp: 1439912 registers.edi: 16940577 registers.eax: 28073 registers.ebp: 4005416980 registers.edx: 663785 registers.ebx: 16972177 registers.esi: 16920826 registers.ecx: 897756739	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 57 89 0c 24 54 e9 a3 0a 00 00 81 c1 3e 7a 69 exception.symbol: random+0x308cc7 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3181767 exception.address: 0x1028cc7 registers.esp: 1439912 registers.edi: 1549541099 registers.eax: 28073 registers.ebp: 4005416980 registers.edx: 663785 registers.ebx: 16947137 registers.esi: 0 registers.ecx: 897756739	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 50 c7 04 24 ce 86 a8 7e 89 34 24 c7 04 24 00 exception.symbol: random+0x311608 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3216904 exception.address: 0x1031608 registers.esp: 1439912 registers.edi: 6237936 registers.eax: 31687 registers.ebp: 4005416980 registers.edx: 6274017 registers.ebx: 16947163 registers.esi: 1152516549 registers.ecx: 17007995	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 68 67 d7 bd 74 89 2c 24 53 e9 6f 02 00 00 exception.symbol: random+0x3110d7 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3215575 exception.address: 0x10310d7 registers.esp: 1439912 registers.edi: 6237936 registers.eax: 31687 registers.ebp: 4005416980 registers.edx: 6274017 registers.ebx: 1114345 registers.esi: 4294938852 registers.ecx: 17007995	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 ec 04 e9 53 1f 00 00 exception.symbol: random+0x3131ac exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3223980 exception.address: 0x10331ac registers.esp: 1439904 registers.edi: 6237936 registers.eax: 1447909480 registers.ebp: 4005416980 registers.edx: 22104 registers.ebx: 1971327157 registers.esi: 16983715 registers.ecx: 20	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: random+0x313b0f exception.address: 0x1033b0f exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 3226383 registers.esp: 1439904 registers.edi: 6237936 registers.eax: 1 registers.ebp: 4005416980 registers.edx: 22104 registers.ebx: 0 registers.esi: 16983715 registers.ecx: 20	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 71 35 2d 12 01 exception.symbol: random+0x3177d6 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3241942 exception.address: 0x10377d6 registers.esp: 1439904 registers.edi: 6237936 registers.eax: 1447909480 registers.ebp: 4005416980 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 16983715 registers.ecx: 10	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 3c 24 89 e7 81 c7 04 00 00 00 56 exception.symbol: random+0x31b573 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3257715 exception.address: 0x103b573 registers.esp: 1439908 registers.edi: 6237936 registers.eax: 28601 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 48114499 registers.esi: 17018060 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 53 51 68 e6 dc f9 7b e9 a9 00 00 00 81 c4 04 exception.symbol: random+0x31b65c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3257948 exception.address: 0x103b65c registers.esp: 1439912 registers.edi: 6237936 registers.eax: 28601 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 48114499 registers.esi: 17046661 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 89 2c 24 51 52 ba ee 72 ef 4e 81 ec 04 00 exception.symbol: random+0x31b43d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3257405 exception.address: 0x103b43d registers.esp: 1439912 registers.edi: 6237936 registers.eax: 1442867808 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 48114499 registers.esi: 17046661 registers.ecx: 4294941852	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: cd 01 eb 00 57 f9 59 57 0f 8a 03 00 00 00 0f bf exception.symbol: random+0x31bb53 exception.instruction: int 1 exception.module: random.exe exception.exception_code: 0xc0000005 exception.offset: 3259219 exception.address: 0x103bb53 registers.esp: 1439872 registers.edi: 0 registers.eax: 1439872 registers.ebp: 4005416980 registers.edx: 380611147 registers.ebx: 17022101 registers.esi: 17021570 registers.ecx: 606333089	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 e9 51 00 00 00 83 ec 04 89 1c 24 68 9b 9e exception.symbol: random+0x32a71d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3319581 exception.address: 0x104a71d registers.esp: 1439908 registers.edi: 17080459 registers.eax: 32668 registers.ebp: 4005416980 registers.edx: 6 registers.ebx: 48114721 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 53 83 ec 04 89 14 24 c7 04 24 73 1e 7f 5f c1 exception.symbol: random+0x32a91e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3320094 exception.address: 0x104a91e registers.esp: 1439912 registers.edi: 17083559 registers.eax: 32668 registers.ebp: 4005416980 registers.edx: 6 registers.ebx: 0 registers.esi: 1971262480 registers.ecx: 262633	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 14 24 e9 3b 01 00 00 89 f9 8b 3c exception.symbol: random+0x32d1be exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3330494 exception.address: 0x104d1be registers.esp: 1439904 registers.edi: 17095514 registers.eax: 959209 registers.ebp: 4005416980 registers.edx: 6 registers.ebx: 694284176 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 88 fe ff ff 89 f8 e9 b7 f7 ff ff 8b 04 24 exception.symbol: random+0x330dcc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3345868 exception.address: 0x1050dcc registers.esp: 1439900 registers.edi: 17095514 registers.eax: 28896 registers.ebp: 4005416980 registers.edx: 6 registers.ebx: 59872 registers.esi: 1971272384 registers.ecx: 17106213	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 68 29 a7 8d 61 89 0c 24 b9 5f 92 b6 0c e9 78 exception.symbol: random+0x3309ff exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3344895 exception.address: 0x10509ff registers.esp: 1439904 registers.edi: 17095514 registers.eax: 28896 registers.ebp: 4005416980 registers.edx: 6 registers.ebx: 1179202795 registers.esi: 4294941260 registers.ecx: 17135109	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 c3 00 00 00 59 81 c4 04 00 00 00 f7 1c 24 exception.symbol: random+0x336d66 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3370342 exception.address: 0x1056d66 registers.esp: 1439900 registers.edi: 17095514 registers.eax: 27005 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 1179202795 registers.esi: 17131131 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 e9 da 02 00 00 89 3c 24 bf 01 00 00 00 81 exception.symbol: random+0x336eeb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3370731 exception.address: 0x1056eeb registers.esp: 1439904 registers.edi: 17095514 registers.eax: 27005 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 1179202795 registers.esi: 17158136 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 50 e9 6c 03 00 00 81 c2 a6 76 e1 73 81 f2 4d exception.symbol: random+0x3367ba exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3368890 exception.address: 0x10567ba registers.esp: 1439904 registers.edi: 17095514 registers.eax: 27005 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 17134156 registers.ecx: 84201	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 50 89 14 24 55 81 ec 04 00 00 00 e9 af ff ff exception.symbol: random+0x344ea3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3428003 exception.address: 0x1064ea3 registers.esp: 1439900 registers.edi: 0 registers.eax: 25441 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 17190488 registers.esi: 6636801 registers.ecx: 2147754302	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 31 c0 ff 34 03 ff 34 24 59 e9 00 00 00 00 68 exception.symbol: random+0x344fe4 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3428324 exception.address: 0x1064fe4 registers.esp: 1439904 registers.edi: 0 registers.eax: 25441 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 17215929 registers.esi: 6636801 registers.ecx: 2147754302	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 68 96 23 26 60 ff 34 24 8b 04 24 81 c4 04 00 exception.symbol: random+0x3451cf exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3428815 exception.address: 0x10651cf registers.esp: 1439904 registers.edi: 0 registers.eax: 4294944496 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 17215929 registers.esi: 6636801 registers.ecx: 1392536160	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 f6 f6 ff ff 41 52 ba d0 94 b1 16 01 d1 5a exception.symbol: random+0x359fb8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3514296 exception.address: 0x1079fb8 registers.esp: 1439872 registers.edi: 0 registers.eax: 30828 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 17304971 registers.esi: 17268452 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 9e 01 00 00 81 ea a9 fe 77 fe 01 d1 e9 46 exception.symbol: random+0x359ec1 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3514049 exception.address: 0x1079ec1 registers.esp: 1439872 registers.edi: 3078732370 registers.eax: 30828 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 17277439 registers.esi: 0 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 89 0c 24 e9 b5 fb ff ff 5b exception.symbol: random+0x35a8c2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3516610 exception.address: 0x107a8c2 registers.esp: 1439872 registers.edi: 17280969 registers.eax: 29581 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 79325743 registers.esi: 0 registers.ecx: 3296747616	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 b9 7f 14 33 76 e9 d6 f9 ff ff 5a 83 c5 04 exception.symbol: random+0x35bbdc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3521500 exception.address: 0x107bbdc registers.esp: 1439868 registers.edi: 17282008 registers.eax: 29327 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2171010792 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 99 ff ff ff 53 89 e3 68 00 b6 2c 39 89 0c exception.symbol: random+0x35b7eb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3520491 exception.address: 0x107b7eb registers.esp: 1439872 registers.edi: 17311335 registers.eax: 29327 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2171010792 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 68 13 64 30 25 e9 68 0b 00 00 31 c8 59 c1 e8 exception.symbol: random+0x35b3fb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3519483 exception.address: 0x107b3fb registers.esp: 1439872 registers.edi: 17285159 registers.eax: 0 registers.ebp: 4005416980 registers.edx: 2130566132 registers.ebx: 1375758944 registers.esi: 2171010792 registers.ecx: 0	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 53 e9 0e 03 00 00 81 0c 24 f4 a2 b7 7f 57 bf exception.symbol: random+0x360830 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3541040 exception.address: 0x1080830 registers.esp: 1439868 registers.edi: 17301814 registers.eax: 29988 registers.ebp: 4005416980 registers.edx: 0 registers.ebx: 65804 registers.esi: 2171010792 registers.ecx: 1969225870	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 55 c7 04 24 02 12 7e 7f 87 0c 24 f7 d1 e9 13 exception.symbol: random+0x360ad3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3541715 exception.address: 0x1080ad3 registers.esp: 1439872 registers.edi: 17331802 registers.eax: 29988 registers.ebp: 4005416980 registers.edx: 0 registers.ebx: 65804 registers.esi: 2171010792 registers.ecx: 1969225870	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 53 c7 04 24 18 d2 5b 7c 89 14 24 55 81 ec 04 exception.symbol: random+0x36014d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3539277 exception.address: 0x108014d registers.esp: 1439872 registers.edi: 17305238 registers.eax: 29988 registers.ebp: 4005416980 registers.edx: 0 registers.ebx: 65804 registers.esi: 908696973 registers.ecx: 1969225870	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 68 de b9 8b 64 89 14 24 ba 5b 5e bd 5c 81 ca exception.symbol: random+0x361b06 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3545862 exception.address: 0x1081b06 registers.esp: 1439868 registers.edi: 17305238 registers.eax: 30277 registers.ebp: 4005416980 registers.edx: 1164939259 registers.ebx: 15402557 registers.esi: 17306144 registers.ecx: 1504790479	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 b9 97 66 ed 2e 81 c9 6a c4 be 0b 55 bd 00 exception.symbol: random+0x361770 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3544944 exception.address: 0x1081770 registers.esp: 1439872 registers.edi: 17305238 registers.eax: 30277 registers.ebp: 4005416980 registers.edx: 1164939259 registers.ebx: 15402557 registers.esi: 17336421 registers.ecx: 1504790479	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 50 89 34 24 e9 f9 00 00 00 29 5c 24 08 e9 48 exception.symbol: random+0x361470 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3544176 exception.address: 0x1081470 registers.esp: 1439872 registers.edi: 82153 registers.eax: 30277 registers.ebp: 4005416980 registers.edx: 0 registers.ebx: 15402557 registers.esi: 17308989 registers.ecx: 1504790479	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 89 0c 24 b9 dc 58 bd 5f c1 exception.symbol: random+0x364c06 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3558406 exception.address: 0x1084c06 registers.esp: 1439872 registers.edi: 3939837675 registers.eax: 17347345 registers.ebp: 4005416980 registers.edx: 1805900241 registers.ebx: 1867804462 registers.esi: 4294942004 registers.ecx: 1504790479	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 51 81 ec 04 00 00 00 89 34 24 50 c7 04 24 f3 exception.symbol: random+0x365cbd exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3562685 exception.address: 0x1085cbd registers.esp: 1439868 registers.edi: 17322963 registers.eax: 28611 registers.ebp: 4005416980 registers.edx: 21162 registers.ebx: 1867804463 registers.esi: 17323616 registers.ecx: 21162	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 57 53 68 c4 a7 f5 3f 5b 81 eb c4 4e 3b e0 e9 exception.symbol: random+0x365c30 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3562544 exception.address: 0x1085c30 registers.esp: 1439872 registers.edi: 17322963 registers.eax: 28611 registers.ebp: 4005416980 registers.edx: 0 registers.ebx: 20441431 registers.esi: 17326363 registers.ecx: 21162	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 af 02 00 00 81 c1 04 00 00 00 83 c1 04 87 exception.symbol: random+0x3713b8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3609528 exception.address: 0x10913b8 registers.esp: 1439868 registers.edi: 17348120 registers.eax: 25496 registers.ebp: 4005416980 registers.edx: 1826696 registers.ebx: 17348088 registers.esi: 17371081 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 9d 01 00 00 5e 81 c4 04 00 00 00 50 e9 3a exception.symbol: random+0x371483 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3609731 exception.address: 0x1091483 registers.esp: 1439872 registers.edi: 17348120 registers.eax: 25496 registers.ebp: 4005416980 registers.edx: 1826696 registers.ebx: 17348088 registers.esi: 17396577 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 68 d0 e9 95 1e ff 34 24 5a 50 89 2c 24 68 b9 exception.symbol: random+0x3718f6 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3610870 exception.address: 0x10918f6 registers.esp: 1439872 registers.edi: 17348120 registers.eax: 2298801283 registers.ebp: 4005416980 registers.edx: 1826696 registers.ebx: 0 registers.esi: 17373809 registers.ecx: 754647040	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb e9 00 00 00 00 68 f1 ba 15 6b e9 ec 02 00 00 exception.symbol: random+0x37324d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3617357 exception.address: 0x109324d registers.esp: 1439868 registers.edi: 17379813 registers.eax: 27616 registers.ebp: 4005416980 registers.edx: 513141200 registers.ebx: 244585606 registers.esi: 34721929 registers.ecx: 530519239	1
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: fb 57 68 59 2e ae 3f 8b 3c 24 52 89 e2 53 bb 17 exception.symbol: random+0x373b5a exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3619674 exception.address: 0x1093b5a registers.esp: 1439872 registers.edi: 17407429 registers.eax: 27616 registers.ebp: 4005416980 registers.edx: 513141200 registers.ebx: 244585606 registers.esi: 34721929 registers.ecx: 530519239	1

Performs some HTTP requests (2 events)

request	GET http://www.maxmind.com/geoip/v2.1/city/me
request	GET https://db-ip.com/demo/home.php?s=175.208.134.152

Allocates read-write-execute memory (usually to unpack itself) (44 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7793f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 704512 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 31, 2024, 10:02 a.m.	process_identifier: 1488 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

random.exe tried to sleep 260 seconds, actually delayed analysis time by 260 seconds

Looks up the external IP address (1 event)

domain

ipinfo.io

Creates a suspicious process (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 31, 2024, 10:03 a.m.	thread_identifier: 2624 thread_handle: 0x000001c8 process_identifier: 2620 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001cc	1	1	0
CreateProcessInternalW May 31, 2024, 10:03 a.m.	thread_identifier: 2692 thread_handle: 0x000001d4 process_identifier: 2688 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001d0	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x000ab400', u'virtual_address': u'0x00001000', u'entropy': 7.980229667297941, u'name': u' \\x00 ', u'virtual_size': u'0x00189000'}

entropy

7.9802296673

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001400', u'virtual_address': u'0x0018a000', u'entropy': 7.834590197906639, u'name': u'.rsrc', u'virtual_size': u'0x00001934'}

entropy

7.83459019791

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0019fe00', u'virtual_address': u'0x0044b000', u'entropy': 7.953752963325544, u'name': u'emrtqrcy', u'virtual_size': u'0x001a0000'}

entropy

7.95375296333

description

A section with a high entropy has been found

entropy

0.995558375635

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Communicates with host for which no DNS query was performed (1 event)

host

147.45.47.126

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (50 out of 95 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA May 31, 2024, 10:02 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:02 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:03 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 31, 2024, 10:03 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 31, 2024, 10:03 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 31, 2024, 10:03 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2024, 10:03 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2024, 10:03 a.m.	class_name: 18467-41 window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131	reg_value	C:\Users\test22\AppData\Local\RageMP131\RageMP131.exe
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Uses Sysinternals tools in order to add additional command line functionality (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 31, 2024, 10:02 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 ec 04 e9 53 1f 00 00 exception.symbol: random+0x3131ac exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3223980 exception.address: 0x10331ac registers.esp: 1439904 registers.edi: 6237936 registers.eax: 1447909480 registers.ebp: 4005416980 registers.edx: 22104 registers.ebx: 1971327157 registers.esi: 16983715 registers.ecx: 20	1	0	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Lionic	Virus.Generic.AI.1!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.RisePro.vc
ALYac	Gen:Trojan.Heur.uE0au0SbZDdk
Cylance	Unsafe
VIPRE	Gen:Trojan.Heur.uE0au0SbZDdk
K7AntiVirus	Trojan ( 005376ae1 )
BitDefender	Gen:Trojan.Heur.uE0au0SbZDdk
K7GW	Trojan ( 005376ae1 )
Cybereason	malicious.654492
Arcabit	Trojan.Heur.uE0au0SbZDdk
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.Themida.HZB
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Risepro-10030665-0
Kaspersky	VHO:Trojan-PSW.Win32.RisePro.gen
MicroWorld-eScan	Gen:Trojan.Heur.uE0au0SbZDdk
Rising	Stealer.Azorult!8.11176 (TFE:2:tdfoi9a83HG)
Emsisoft	Gen:Trojan.Heur.uE0au0SbZDdk (B)
McAfeeD	Real Protect-LS!85D6CF665449
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.85d6cf6654492780
Sophos	Mal/RisePro-A
Google	Detected
MAX	malware (ai score=87)
Gridinsoft	Trojan.Heur!.038120A1
Microsoft	Trojan:Win32/RisePro.RP!MTB
ZoneAlarm	VHO:Trojan-PSW.Win32.RisePro.gen
GData	Gen:Trojan.Heur.uE0au0SbZDdk
AhnLab-V3	Trojan/Win.RisePro.R649725
BitDefenderTheta	AI:Packer.FEFDF7111C
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2900902081
Panda	Trj/Genetic.gen
Zoner	Probably Heur.ExeHeaderL
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (D)

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All