Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 15, 2024, 9:34 a.m.	July 15, 2024, 9:39 a.m.

Size	2.4MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`54b737b86fddcb3ca236a6cf743e66e7`
SHA256	`cb5be74fea917e24244f7b10ec4f838fcaedc1683af463868e2dd0f832ace0b4`
CRC32	`7BEF331C`
ssdeep	`49152:6vYtGgyDMUzbX+BGHsTuky4x/0DzZHj0/Acy:6KGhvJHsa54+dyAcy`
PDB Path	Rrobknnz-TPBA.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

Rrobknnz-TPBA.exe "C:\Users\test22\AppData\Local\Temp\Rrobknnz-TPBA.exe"
1476
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAHIAbwBiAGsAbgBuAHoALQBUAFAAQgBBAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2276

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 15, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 15, 2024, 9:34 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:34 a.m.			0	0
IsDebuggerPresent July 15, 2024, 9:34 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051a2c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051aac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051b040 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 15, 2024, 9:35 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ae80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Rrobknnz-TPBA.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 15, 2024, 9:34 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 268 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00561000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046ae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 15, 2024, 9:34 a.m.	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	Powershell -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAHIAbwBiAGsAbgBuAHoALQBUAFAAQgBBAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAHIAbwBiAGsAbgBuAHoALQBUAFAAQgBBAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA==

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\Rrobknnz-TPBA.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW July 15, 2024, 9:34 a.m.	show_type: 0 filepath_r: Powershell parameters: -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAHQAZQBzAHQAMgAyAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAHIAbwBiAGsAbgBuAHoALQBUAFAAQgBBAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlAA== filepath: Powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00201200', u'virtual_address': u'0x00002000', u'entropy': 7.981905109602675, u'name': u'.text', u'virtual_size': u'0x00201084'}

entropy

7.9819051096

description

A section with a high entropy has been found

entropy

0.852721229747

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 15, 2024, 9:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 15, 2024, 9:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 7b7e2d53d2a87b659c9ba5fc496814a8f99640ec

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
Skyhigh	Artemis!Trojan
McAfee	Artemis!54B737B86FDD
Cylance	Unsafe
VIPRE	Trojan.GenericKD.61709716
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005974351 )
BitDefender	Trojan.GenericKD.61709716
K7GW	Trojan ( 005974351 )
Cybereason	malicious.86fddc
Arcabit	Trojan.Generic.D3AD9D94
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.NKC
APEX	Malicious
Avast	Win32:CrypterX-gen [Trj]
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba	TrojanSpy:MSIL/Stealer.39217959
MicroWorld-eScan	Trojan.GenericKD.61709716
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:vCzu5s18/1K6Wugn+9aE3w)
Emsisoft	Trojan.GenericKD.61709716 (B)
DrWeb	Trojan.PWS.Siggen3.21693
McAfeeD	Real Protect-LS!54B737B86FDD
FireEye	Generic.mg.54b737b86fddcb3c
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Krypt
Jiangmin	TrojanSpy.MSIL.ctis
Webroot	W32.Trojan.GenKD
Google	Detected
MAX	malware (ai score=86)
Antiy-AVL	Trojan/MSIL.GenKryptik
Kingsoft	malware.kb.c.1000
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Trojan.GenericKD.61709716
Varist	W32/ABTrojan.KYHX-8510
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.36808.wo0@a0j4Vbi
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.MSIL
Malwarebytes	Generic.Trojan.Downloader.DDS
Panda	Trj/Chgt.AA
TrendMicro-HouseCall	TROJ_GEN.R002H0CGD24
Tencent	Msil.Trojan-Downloader.Ader.Kcnw
Yandex	Trojan.GenKryptik!aSCp/woGSPk
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.73709669.susgen
Fortinet	PossibleThreat

Rrobknnz-TPBA.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All