popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

a.exe

.NET framework(MSIL) Malicious Library DNS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 11, 2024, 9:15 a.m. July 11, 2024, 9:19 a.m.
Size 699.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 56fae07d0d9ee560ef2fb4c536868b11
SHA256 b3ecfad7812c038effe03852fe7794bd52d291a97d858245c48ba8fd8408e131
CRC32 842D4542
ssdeep 12288:FnMuCLXNc0xC0eQJNPPFW1HJmLCstwCD5Nyk9wYKHsXUB0vioVUp24Ebp:FMfLXNcECriN1W1HJ4UCD7KJB06oVUpA
PDB Path VlUv.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
maxlogs.webhop.me
newsddawork.3utilities.com
A 104.243.242.169
104.243.242.169
IP Address Status Action
104.243.242.169 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:64894 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:64631 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:60225 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:57986 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:57631 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:58805 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:50383 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:60141 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:52175 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:64083 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:50816 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:58540 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:57225 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:52004 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:52475 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:65119 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:53789 -> 8.8.8.8:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic
UDP 192.168.56.103:51466 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:64354 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:55798 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:55221 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53 2028677 ET POLICY DNS Query to DynDNS Domain *.3utilities .com Potentially Bad Traffic
UDP 192.168.56.103:54278 -> 8.8.4.4:53 2028702 ET POLICY DNS Query to DynDNS Domain *.webhop .me Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path VlUv.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
domain newsddawork.3utilities.com
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00500000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02150000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006bf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00440000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00480000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72ee2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00465000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00467000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00820000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000ae400', u'virtual_address': u'0x00002000', u'entropy': 7.835499270048169, u'name': u'.text', u'virtual_size': u'0x000ae214'} entropy 7.83549927005 description A section with a high entropy has been found
entropy 0.997138769671 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002e8
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description RegSvcs.exe tried to sleep 4656974908 seconds, actually delayed analysis time by 4656974908 seconds
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host reg_value C:\Program Files (x86)\SMTP Host\smtphost.exe
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW  ]  H.text˜Ç È `.reloc Ê@B.rsrc ] ^Ì@@
base_address: 0x00400000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

WriteProcessMemory

 buffer: à ”7
base_address: 0x00420000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2428
process_handle: 0x000002e8
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW  ]  H.text˜Ç È `.reloc Ê@B.rsrc ] ^Ì@@
base_address: 0x00400000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0
Process injection Process 1680 called NtSetContextThread to modify thread in remote process 2428
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002e4
process_identifier: 2428
1 0 0
file C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:Zone.Identifier
Process injection Process 1680 resumed a thread in remote process 2428
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002e4
suspend_count: 1
process_identifier: 2428
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x000002d8
suspend_count: 1
process_identifier: 1680
1 0 0

CreateProcessInternalW

 thread_identifier: 2432
thread_handle: 0x000002e4
process_identifier: 2428
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002e8
1 1 0

NtGetContextThread

 thread_handle: 0x000002e4
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2428
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002e8
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW  ]  H.text˜Ç È `.reloc Ê@B.rsrc ] ^Ì@@
base_address: 0x00400000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

WriteProcessMemory

 buffer: à ”7
base_address: 0x00420000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00422000
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2428
process_handle: 0x000002e8
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002e4
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000002e4
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000001d4
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000002b0
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x0000030c
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x00000378
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x0000038c
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000003a4
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000003bc
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000003e8
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x000003bc
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x00000404
suspend_count: 1
process_identifier: 2428
1 0 0

NtResumeThread

 thread_handle: 0x00000438
suspend_count: 1
process_identifier: 2428
1 0 0
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Nanocore.i!c
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win32.Generic.jc
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
VirIT Trojan.Win32.MSIL_Heur.A
Symantec Scr.Malcode!gdn34
ESET-NOD32 a variant of MSIL/Kryptik.ALXS
APEX Malicious
McAfee Artemis!56FAE07D0D9E
Avast Win32:PWSX-gen [Trj]
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba Trojan:MSIL/GenKryptik.d80ac847
Rising Trojan.Kryptik!8.8 (CLOUD)
F-Secure Trojan.TR/AD.Nanocore.mzlva
McAfeeD ti!B3ECFAD7812C
Trapmine malicious.moderate.ml.score
Sophos Troj/Krypt-ABH
Ikarus Trojan.MSIL.Krypt
Webroot W32.Malware.Gen
Google Detected
Avira TR/AD.Nanocore.mzlva
Antiy-AVL Trojan/MSIL.GenKryptik
Kingsoft MSIL.Trojan-PSW.Agensla.gen
Gridinsoft Trojan.Win32.NanoCore.tr
Microsoft Trojan:MSIL/Remcos.ASKL!MTB
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData MSIL.Backdoor.Nancat.NBY6QV
Varist W32/MSIL_Kryptik.KUK.gen!Eldorado
DeepInstinct MALICIOUS
VBA32 TrojanLoader.MSIL.DaVinci.Heur
Malwarebytes Trojan.Crypt.MSIL
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H0DGA24
Tencent Msil.Trojan.Genkryptik.Bplw
SentinelOne Static AI - Malicious PE
Fortinet MSIL/GenKryptik.FQQD!tr
AVG Win32:PWSX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Trojan:MSIL/GenKryptik.GVIW
dead_host 192.168.56.103:49171
dead_host 192.168.56.103:49170
dead_host 192.168.56.103:49175
dead_host 192.168.56.103:49173
dead_host 192.168.56.103:49172
dead_host 104.243.242.169:1620
dead_host 192.168.56.103:49176
dead_host 192.168.56.103:49174
dead_host 192.168.56.103:49164
dead_host 192.168.56.103:49169
dead_host 192.168.56.103:49167
dead_host 192.168.56.103:49168
dead_host 192.168.56.103:49166