Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 5, 2024, 7:39 a.m.	June 5, 2024, 7:43 a.m.

Size	664.6KB
Type	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
MD5	`957f18ab4db251c4c04ec51d97e27c4b`
SHA256	`6679e14d4e7d4110251a984e8c4580330de9fd550faf91757354360673beec72`
CRC32	`BC493C92`
ssdeep	`12288:AL5GHMbryoAaC2ena1sfiAWlKDxBIiZxTr9x1dWoJBwucG1ieHpDu:A1yMbGoYCsVNBlz9x1dWadAeHpDu`
PDB Path	@ *I·£ ¸ù9i . õ`¼QìåÃ\|ºd¹x)¿LÌ¨_Å{ÔîÑDúô"tÔ0²èÁhñK÷i´xFwú[µæ¤Ç{M7?ìýd&6¯Û"==ôÏ)<Ïvî°úàñ[
Yara	IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

NUZfgivQhifX46kon.exe "C:\Users\test22\AppData\Local\Temp\NUZfgivQhifX46kon.exe"
800
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2376

Name	Response	Post-Analysis Lookup
api.ipify.org	A 104.26.13.205 A 172.67.74.152 A 104.26.12.205	104.26.12.205

IP Address	Status	Action
104.26.13.205	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 8.8.8.8:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2047702	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup	Misc activity
TCP 192.168.56.103:49166 -> 104.26.13.205:443	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	Misc activity
TCP 192.168.56.103:49166 -> 104.26.13.205:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49166 104.26.13.205:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=ipify.org	d7:26:8f:42:ea:20:0d:40:ec:e2:9c:42:dd:94:45:64:2a:b8:c6:ce

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 5, 2024, 7:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 7:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 7:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 5, 2024, 7:39 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 5, 2024, 7:31 a.m.			0	0
IsDebuggerPresent June 5, 2024, 7:31 a.m.			0	0
IsDebuggerPresent June 5, 2024, 7:39 a.m.			0	0
IsDebuggerPresent June 5, 2024, 7:39 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey June 5, 2024, 7:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000377010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 7:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000377080 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 5, 2024, 7:32 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000377080 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

@ *I·£ ¸ù9i . õ`¼QìåÃ|ºd¹x)¿LÌ¨_Å{ÔîÑDúô"tÔ0²èÁhñK÷i´xFwú[µæ¤Ç{M7?ìýd&6¯Û"==ôÏ)<Ïvî°úàñ[

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 5, 2024, 7:31 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 5, 2024, 7:32 a.m.	stacktrace: RtlInitUnicodeStringEx+0x24 RtlFreeAnsiString-0x22c ntdll+0x553e4 @ 0x777153e4 BasepCheckBadapp+0xa2b LCMapStringW-0x785 kernel32+0x2064b @ 0x76fe064b CreateProcessInternalW+0x7dc BasepCheckBadapp-0xc94 kernel32+0x1ef8c @ 0x76fdef8c New_kernel32_CreateProcessInternalW+0x208 New_kernel32_CreateRemoteThread-0x198 @ 0x749a9b5a CreateProcessW+0x6c NeedCurrentDirectoryForExePathW-0x14 kernel32+0x21c1c @ 0x76fe1c1c 0x7fe93fa03b7 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83 mscorlib+0x563bfc @ 0x7fef24f3bfc mscorlib+0x486001 @ 0x7fef2416001 0x7fe93f8c055 0x7fe93f8b8eb 0x7fe93f8b09f 0x7fe93f86f5d 0x7fe93f86bd4 0x7fe93f8624d 0x7fe93f9ba1b 0x7fe93fa0227 0x7fe93f9f88d CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83 mscorlib+0x563c95 @ 0x7fef24f3c95 mscorlib+0x486001 @ 0x7fef2416001 0x7fe93f8c055 0x7fe93f8b8eb 0x7fe93f8b09f 0x7fe93f86f5d 0x7fe93f86bd4 0x7fe93f8624d 0x7fe93f8338c 0x7fe93f99832 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83 mscorlib+0x563c95 @ 0x7fef24f3c95 mscorlib+0x486001 @ 0x7fef2416001 mscorlib+0x48c543 @ 0x7fef241c543 CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83 mscorlib+0x563bfc @ 0x7fef24f3bfc mscorlib+0x486001 @ 0x7fef2416001 microsoft+0x786c6 @ 0x7feef3d86c6 microsoft+0x607a7 @ 0x7feef3c07a7 microsoft+0x5fe83 @ 0x7feef3bfe83 microsoft+0x1f9daf @ 0x7feef559daf CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242 StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042 StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83 mscorlib+0x563bfc @ 0x7fef24f3bfc mscorlib+0x486001 @ 0x7fef2416001 0x7fe93f8200e 0x7fe93f80d8e 0x7fe93f808e4 system+0x28162b @ 0x7fef143162b 0x7fe93f8013a CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713 exception.instruction_r: 66 f2 af 48 8b 3c 24 48 f7 d1 48 ff c9 48 81 f9 exception.symbol: RtlInitUnicodeStringEx+0x24 RtlFreeAnsiString-0x22c ntdll+0x553e4 exception.instruction: scasw ax, word ptr [rdi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 349156 exception.address: 0x777153e4 registers.r14: 1567736 registers.r15: 4 registers.rcx: -1 registers.rsi: 3553712 registers.r10: 33495998976491630 registers.rbx: 0 registers.rsp: 1567360 registers.r11: 3942668 registers.r8: 1549016 registers.r9: 0 registers.rdx: 4406636577536 registers.r12: 1 registers.rbp: 1567648 registers.rdi: 1568032 registers.rax: 0 registers.r13: 1568080	1	0	0
__exception__ June 5, 2024, 7:39 a.m.	stacktrace: 0x880694 0x88061d 0x880435 0x8800e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7469f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74797f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74794de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x88393f registers.esp: 3994248 registers.edi: 3994272 registers.eax: 0 registers.ebp: 3994284 registers.edx: 195 registers.ebx: 3994524 registers.esi: 40084528 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 5, 2024, 7:32 a.m.

stacktrace:

RtlInitUnicodeStringEx+0x24 RtlFreeAnsiString-0x22c ntdll+0x553e4 @ 0x777153e4
BasepCheckBadapp+0xa2b LCMapStringW-0x785 kernel32+0x2064b @ 0x76fe064b
CreateProcessInternalW+0x7dc BasepCheckBadapp-0xc94 kernel32+0x1ef8c @ 0x76fdef8c
New_kernel32_CreateProcessInternalW+0x208 New_kernel32_CreateRemoteThread-0x198 @ 0x749a9b5a
CreateProcessW+0x6c NeedCurrentDirectoryForExePathW-0x14 kernel32+0x21c1c @ 0x76fe1c1c
0x7fe93fa03b7
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83
mscorlib+0x563bfc @ 0x7fef24f3bfc
mscorlib+0x486001 @ 0x7fef2416001
0x7fe93f8c055
0x7fe93f8b8eb
0x7fe93f8b09f
0x7fe93f86f5d
0x7fe93f86bd4
0x7fe93f8624d
0x7fe93f9ba1b
0x7fe93fa0227
0x7fe93f9f88d
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83
mscorlib+0x563c95 @ 0x7fef24f3c95
mscorlib+0x486001 @ 0x7fef2416001
0x7fe93f8c055
0x7fe93f8b8eb
0x7fe93f8b09f
0x7fe93f86f5d
0x7fe93f86bd4
0x7fe93f8624d
0x7fe93f8338c
0x7fe93f99832
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83
mscorlib+0x563c95 @ 0x7fef24f3c95
mscorlib+0x486001 @ 0x7fef2416001
mscorlib+0x48c543 @ 0x7fef241c543
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83
mscorlib+0x563bfc @ 0x7fef24f3bfc
mscorlib+0x486001 @ 0x7fef2416001
microsoft+0x786c6 @ 0x7feef3d86c6
microsoft+0x607a7 @ 0x7feef3c07a7
microsoft+0x5fe83 @ 0x7feef3bfe83
microsoft+0x1f9daf @ 0x7feef559daf
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83
mscorlib+0x563bfc @ 0x7fef24f3bfc
mscorlib+0x486001 @ 0x7fef2416001
0x7fe93f8200e
0x7fe93f80d8e
0x7fe93f808e4
system+0x28162b @ 0x7fef143162b
0x7fe93f8013a
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713

exception.instruction_r: 66 f2 af 48 8b 3c 24 48 f7 d1 48 ff c9 48 81 f9
exception.symbol: RtlInitUnicodeStringEx+0x24 RtlFreeAnsiString-0x22c ntdll+0x553e4
exception.instruction: scasw ax, word ptr [rdi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 349156
exception.address: 0x777153e4
registers.r14: 1567736
registers.r15: 4
registers.rcx: -1
registers.rsi: 3553712
registers.r10: 33495998976491630
registers.rbx: 0
registers.rsp: 1567360
registers.r11: 3942668
registers.r8: 1549016
registers.r9: 0
registers.rdx: 4406636577536
registers.r12: 1
registers.rbp: 1567648
registers.rdi: 1568032
registers.rax: 0
registers.r13: 1568080

__exception__

June 5, 2024, 7:39 a.m.

stacktrace:

0x880694
0x88061d
0x880435
0x8800e8
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72ee2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72ef264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72ef2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72fa74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72fa7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73031dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73031e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73031f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7303416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7469f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74797f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74794de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x88393f
registers.esp: 3994248
registers.edi: 3994272
registers.eax: 0
registers.ebp: 3994284
registers.edx: 195
registers.ebx: 3994524
registers.esi: 40084528
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET https://api.ipify.org/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 181 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002100000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:31 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory June 5, 2024, 7:32 a.m.	process_identifier: 800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory June 5, 2024, 7:32 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 3 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000000000 process_handle: 0xffffffffffffffff		-1073741800

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Looks up the external IP address (1 event)

domain

api.ipify.org

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 5, 2024, 7:39 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000d200', u'virtual_address': u'0x0000c000', u'entropy': 6.880230514528858, u'name': u'.rsrc', u'virtual_size': u'0x0000d196'}

entropy

6.88023051453

description

A section with a high entropy has been found

entropy

0.614035087719

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 5, 2024, 7:31 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 5, 2024, 7:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (13 events)

description	Win Trojan AgentTesla	rule	Win_Trojan_AgentTesla_M_B_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications smtp	rule	Network_SMTP_dotNet
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 43f080834407b3e79ca83b5c4b5b2da04e484ad5

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 5, 2024, 7:32 a.m.	process_identifier: 2376 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000258	1	0	0

A process attempted to delay the analysis task. (1 event)

description

RegAsm.exe tried to sleep 2728223 seconds, actually delayed analysis time by 2728223 seconds

Harvests credentials from local FTP client softwares (5 events)

file	C:\Users\test22\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect
file	C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\SOFTWARE\FTPWare\COREFTP\Sites

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¬ÎJfà ¾ À@ @L¾OÀFà H.text¤ `.rsrcFÀ¢@@.relocà¨@B base_address: 0x0000000000400000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: P8h À¼\Ãê¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion1.0.0.0t)InternalNamefe669a34-3e15-4019-8593-4c1c330bc15b.exe(LegalCopyright \|)OriginalFilenamefe669a34-3e15-4019-8593-4c1c330bc15b.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x000000000043c000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: ° > base_address: 0x000000000043e000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2376 process_handle: 0x0000000000000258	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¬ÎJfà ¾ À@ @L¾OÀFà H.text¤ `.rsrcFÀ¢@@.relocà¨@B base_address: 0x0000000000400000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA June 5, 2024, 7:39 a.m.	thread_identifier: 0 callback_function: 0x006e08a2 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	655805	0

Harvests credentials from local email clients (6 events)

file	C:\Users\test22\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect
file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 800 resumed a thread in remote process 2376
NtResumeThread June 5, 2024, 7:32 a.m.	thread_handle: 0x000000000000025c suspend_count: 1 process_identifier: 2376	1	0	0

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
NtResumeThread June 5, 2024, 7:31 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 800	1	0
NtResumeThread June 5, 2024, 7:31 a.m.	thread_handle: 0x0000000000000140 suspend_count: 1 process_identifier: 800	1	0
NtResumeThread June 5, 2024, 7:31 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 800	1	0
NtResumeThread June 5, 2024, 7:32 a.m.	thread_handle: 0x000000000000022c suspend_count: 1 process_identifier: 800	1	0
CreateProcessInternalW June 5, 2024, 7:32 a.m.	thread_identifier: 2380 thread_handle: 0x000000000000025c process_identifier: 2376 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000258	1	1
NtUnmapViewOfSection June 5, 2024, 7:32 a.m.	base_address: 0x0000000000400000 region_size: 14286848 process_identifier: 2376 process_handle: 0x0000000000000258		-1073741799
NtAllocateVirtualMemory June 5, 2024, 7:32 a.m.	process_identifier: 2376 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000258	1	0
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¬ÎJfà ¾ À@ @L¾OÀFà H.text¤ `.rsrcFÀ¢@@.relocà¨@B base_address: 0x0000000000400000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: base_address: 0x0000000000402000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: P8h À¼\Ãê¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion1.0.0.0t)InternalNamefe669a34-3e15-4019-8593-4c1c330bc15b.exe(LegalCopyright \|)OriginalFilenamefe669a34-3e15-4019-8593-4c1c330bc15b.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x000000000043c000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: ° > base_address: 0x000000000043e000 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
WriteProcessMemory June 5, 2024, 7:32 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2376 process_handle: 0x0000000000000258	1	1
NtResumeThread June 5, 2024, 7:32 a.m.	thread_handle: 0x000000000000025c suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x000001f0 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x00000230 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x000002dc suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x000003e8 suspend_count: 1 process_identifier: 2376	1	0
NtResumeThread June 5, 2024, 7:39 a.m.	thread_handle: 0x00000534 suspend_count: 1 process_identifier: 2376	1	0

NUZfgivQhifX46kon.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All