Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 7, 2024, 6:45 p.m.	July 7, 2024, 6:48 p.m.

Size	1.0MB
Type	ASCII text, with very long lines
MD5	`b099d0ec774fccc05b662d86eaba027a`
SHA256	`82f7781ebf1aa649a3697ed570fc11ba0a35b810782c953c145850f314c07e21`
CRC32	`18B5A62C`
ssdeep	`1536:dgN5UDzCIS4llJ0k2+X6FHkFYx+Sj7ys+6restOmipCmjfXoHLlnUo9RSgqHvjCI:I5U0IFYO9+en/o6Btp`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\qwerty.ps1
3012
- eqih.exe "C:\Users\Public\eqih.exe"
  2200
  - eqih.exe "C:\Users\Public\eqih.exe"
    2160

Name	Response	Post-Analysis Lookup
lastimaners.ug	A 91.215.85.223	91.215.85.223

IP Address	Status	Action
164.124.101.2	Active	Moloch
91.215.85.223	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 91.215.85.223:80 -> 192.168.56.102:49167	2400013	ET DROP Spamhaus DROP Listed Traffic Inbound group 14	Misc Attack
TCP 91.215.85.223:80 -> 192.168.56.102:49170	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 91.215.85.223:80 -> 192.168.56.102:49169	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 91.215.85.223:80 -> 192.168.56.102:49167	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 91.215.85.223:80 -> 192.168.56.102:49171	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW July 7, 2024, 6:41 p.m.	buffer: True console_handle: 0x00000013	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 7, 2024, 6:41 p.m.		1	1	0

One or more processes crashed (50 out of 3103 events)

Time & API	Arguments	Status
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: eqih+0xc226 @ 0x40c226 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 eqih+0x14e2 @ 0x4014e2 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: e5 14 17 f8 4b 04 03 6a 65 0b 8d 3b b8 84 09 c2 exception.instruction: in eax, 0x14 exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e90a0c registers.esp: 1637056 registers.edi: 0 registers.eax: 4248305 registers.ebp: 1637292 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32049124 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: eqih+0xc226 @ 0x40c226 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 eqih+0x14e2 @ 0x4014e2 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: e4 16 e9 f7 fc ff ff 55 e9 3d 01 00 00 8b 2c 24 exception.instruction: in al, 0x16 exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e90674 registers.esp: 1637060 registers.edi: 0 registers.eax: 4248305 registers.ebp: 1637292 registers.edx: 1637248 registers.ebx: 32048380 registers.esi: 6889248 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: eqih+0xc226 @ 0x40c226 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 eqih+0x14e2 @ 0x4014e2 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: e6 7d e9 98 0c 00 00 e9 71 04 00 00 e9 27 03 00 exception.instruction: out 0x7d, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e90554 registers.esp: 1637032 registers.edi: 0 registers.eax: 4248305 registers.ebp: 1637292 registers.edx: 1637248 registers.ebx: 1637276 registers.esi: 32047155 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052649 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052653 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052657 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052661 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052665 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052669 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052673 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052677 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052681 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052685 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052689 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052693 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052697 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052701 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052705 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052709 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052713 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052717 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052721 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052725 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052729 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052733 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052737 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052741 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052745 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052749 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052753 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052757 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052761 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052765 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052769 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052773 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052777 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052781 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052785 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052789 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052793 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052797 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052801 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052805 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052809 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052813 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052817 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052821 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052825 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052829 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1
__exception__ July 7, 2024, 6:41 p.m.	stacktrace: exception.instruction_r: e5 93 e9 d1 05 00 00 e9 62 ff ff ff 53 e9 db 0a exception.instruction: in eax, -0x6d exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x1e908ea registers.esp: 1637048 registers.edi: 32051011 registers.eax: 4248305 registers.ebp: 32052833 registers.edx: 1637248 registers.ebx: 6891288 registers.esi: 32064989 registers.ecx: 32047104	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (4 events)

request	GET http://lastimaners.ug/zxcvb.exe
request	GET http://lastimaners.ug/asdfg.exe
request	GET http://lastimaners.ug/asdf.EXE
request	GET http://lastimaners.ug/zxcv.EXE

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0270f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02699000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02871000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02872000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02873000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02874000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02875000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7748f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2200 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e90000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7748f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742d2000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\bvcfsds.exe
file	C:\Users\test22\AppData\Local\Temp\bvasdvdfsds.exe
file	C:\Users\test22\AppData\Local\Temp\cvbfsds.exe
file	C:\Users\Public\eqih.exe
file	C:\Users\test22\AppData\Local\Temp\dfgdvdfsds.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 7, 2024, 6:41 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

An executable file was downloaded by the process eqih.exe (4 events)

Time & API	Arguments	Status	Return
recv July 7, 2024, 6:41 p.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 07 Jul 2024 09:46:09 GMT Content-Type: application/x-msdos-program Content-Length: 5705216 Connection: keep-alive Last-Modified: Sun, 23 Jun 2024 05:57:13 GMT ETag: "570e00-61b885609a8e2" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELvwfàWÒ#W @W@ W`#WL@W`Wà#W H.textèW W `.rsrc@WW@@.reloc`WW@BHäW &àÞV05s %o %o %o %o %o %o (*00o 8( >õ((+(( Ý&Ý( 9 o ~%: received: 1024 socket: 800	1	1024
recv July 7, 2024, 6:41 p.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 07 Jul 2024 09:46:10 GMT Content-Type: application/x-msdos-program Content-Length: 5705216 Connection: keep-alive Last-Modified: Sun, 23 Jun 2024 05:50:40 GMT ETag: "570e00-61b883ea77a8c" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELvwfàWÒ#W @W@ W`#WL@W`Wà#W H.textèW W `.rsrc@WW@@.reloc`WW@BHäW &àÞV05s %o %o %o %o %o %o (*00o 8( >õ((+(( Ý&Ý( 9 o ~%: received: 1024 socket: 1012	1	1024
recv July 7, 2024, 6:41 p.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 07 Jul 2024 09:46:10 GMT Content-Type: application/x-msdos-program Content-Length: 5705216 Connection: keep-alive Last-Modified: Sun, 23 Jun 2024 05:50:00 GMT ETag: "570e00-61b883c3f54d5" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELvwfàWÒ#W @W@ W`#WL@W`Wà#W H.textèW W `.rsrc@WW@@.reloc`WW@BHäW &àÞV05s %o %o %o %o %o %o (*00o 8( >õ((+(( Ý&Ý( 9 o ~%: received: 1024 socket: 996	1	1024
recv July 7, 2024, 6:41 p.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 07 Jul 2024 09:46:10 GMT Content-Type: application/x-msdos-program Content-Length: 5705216 Connection: keep-alive Last-Modified: Sun, 23 Jun 2024 05:56:22 GMT ETag: "570e00-61b885305cff6" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELvwfàWÒ#W @W@ W`#WL@W`Wà#W H.textèW W `.rsrc@WW@@.reloc`WW@BHäW &àÞV05s %o %o %o %o %o %o (*00o 8( >õ((+(( Ý&Ý( 9 o ~%: received: 1024 socket: 1004	1	1024

Potentially malicious URLs were found in the process memory dump (5 events)

url	http://lastimaners.ug/zxcvb.exe
url	http://lastimaners.ug/zxcv.EXE
url	http://lastimaners.ug/asdf.EXE
url	http://lastimaners.ug/asdfg.exe
url	http://google.com

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vba
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 0fb9b5070149067e2625c1f7949f4707f0452b0e

Drops a binary and executes it (1 event)

file	C:\Users\Public\eqih.exe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2200 called NtSetContextThread to modify thread in remote process 2160
NtSetContextThread July 7, 2024, 6:41 p.m.	registers.eip: 4214784 registers.esp: 1638384 registers.edi: 0 registers.eax: 4198508 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2001207748 thread_handle: 0x00000118 process_identifier: 2160	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Users\Public\eqih.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2200 resumed a thread in remote process 2160
NtResumeThread July 7, 2024, 6:41 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2160	1	0	0

The process powershell.exe wrote an executable file to disk (1 event)

file	C:\Users\Public\eqih.exe

A potential heapspray has been detected. 261 megabytes was sprayed onto the heap of the powershell.exe process (2 events)

count

428

name

heapspray

process

powershell.exe

total_mb

123

length

303104

protection

PAGE_READWRITE

count

2214

name

heapspray

process

powershell.exe

total_mb

138

length

65536

protection

PAGE_READWRITE

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Lionic	Trojan.Script.PowerShell.b!c
Skyhigh	BehavesLike.PS.Dropper.tx
ALYac	Trojan.GenericKD.71597040
VIPRE	Trojan.GenericKD.71597040
Arcabit	Trojan.Generic.D4447BF0
Symantec	Trojan.Malscript
ESET-NOD32	PowerShell/TrojanDropper.Agent.ACH
Avast	PwrSh:Dropper-AC [Drp]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Dropper.PowerShell.Agent.gen
BitDefender	Trojan.GenericKD.71597040
MicroWorld-eScan	Trojan.GenericKD.71597040
Rising	Dropper.Agent/PS!1.BBF1 (CLASSIC)
Emsisoft	Trojan.GenericKD.71597040 (B)
F-Secure	Trojan.TR/PowerShell.Gen
DrWeb	Trojan.DownLoader34.62936
FireEye	Trojan.GenericKD.71597040
Ikarus	Trojan-Dropper.PowerShell.Agent
Google	Detected
Avira	TR/PowerShell.Gen
Kingsoft	Win32.Troj.Undef.a
Gridinsoft	Malware.U.ZgRAT.tr
Xcitium	TrojWare.Script.TrojanDropper.Agent.S@8b3nm6
Microsoft	Trojan:Win32/Znyonm
GData	Script.Trojan-Dropper.Agent.ATH
Varist	PSH/DropExe.A.gen!Camelot
Tencent	Win32.Trojan.Powershell.Gajl
MAX	malware (ai score=82)
AVG	PwrSh:Dropper-AC [Drp]

Executed a process and injected code into it, probably while unpacking (12 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 7, 2024, 6:41 p.m.	thread_identifier: 2188 thread_handle: 0x0000041c process_identifier: 2200 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\Public\eqih.exe" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000003c0	1	1
NtResumeThread July 7, 2024, 6:41 p.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 3012	1	0
CreateProcessInternalW July 7, 2024, 6:41 p.m.	thread_identifier: 196 thread_handle: 0x00000118 process_identifier: 2160 current_directory: filepath: C:\Users\Public\eqih.exe track: 1 command_line: filepath_r: C:\Users\Public\eqih.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000120	1	1
NtGetContextThread July 7, 2024, 6:41 p.m.	thread_handle: 0x00000118	1	0
NtUnmapViewOfSection July 7, 2024, 6:41 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2160 process_handle: 0x00000120	1	0
NtMapViewOfSection July 7, 2024, 6:41 p.m.	section_handle: 0x000000e0 process_identifier: 2160 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 32768 process_handle: 0x00000120	1	0
NtSetContextThread July 7, 2024, 6:41 p.m.	registers.eip: 4214784 registers.esp: 1638384 registers.edi: 0 registers.eax: 4198508 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2001207748 thread_handle: 0x00000118 process_identifier: 2160	1	0
NtResumeThread July 7, 2024, 6:41 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2160	1	0
CreateProcessInternalW July 7, 2024, 6:41 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\bvasdvdfsds.exe track: 0 command_line: "C:\Users\test22\AppData\Local\Temp\bvasdvdfsds.exe" 0 filepath_r: C:\Users\test22\AppData\Local\Temp\bvasdvdfsds.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW July 7, 2024, 6:41 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\dfgdvdfsds.exe track: 0 command_line: "C:\Users\test22\AppData\Local\Temp\dfgdvdfsds.exe" 0 filepath_r: C:\Users\test22\AppData\Local\Temp\dfgdvdfsds.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW July 7, 2024, 6:41 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\cvbfsds.exe track: 0 command_line: "C:\Users\test22\AppData\Local\Temp\cvbfsds.exe" 0 filepath_r: C:\Users\test22\AppData\Local\Temp\cvbfsds.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW July 7, 2024, 6:41 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\bvcfsds.exe track: 0 command_line: "C:\Users\test22\AppData\Local\Temp\bvcfsds.exe" 0 filepath_r: C:\Users\test22\AppData\Local\Temp\bvcfsds.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000		0

qwerty.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All