Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 11, 2024, 2:25 p.m.	Aug. 11, 2024, 2:56 p.m.

Size	3.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5a49dfb1f8484d86675a3811e95c5020`
SHA256	`61ea68229965be4facdaaacada953ad6139b6f4107a4e2d1631ca4cd9ece528a`
CRC32	`0DE54510`
ssdeep	`98304:oaoywEZ0eTkwxXa2irMi8RiEq3TYL9n3wOkeJsHk/Z:oPyNBxXa3rnEsS9AJHEZ`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library MALWARE_Win_VT_RedLine - Detects RedLine infostealer PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file UltraVNC_Zero - UltraVNC Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

sthealthclient.exe "C:\Users\test22\AppData\Local\Temp\sthealthclient.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
47.104.173.216	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 47.104.173.216:9876	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 47.104.173.216:9876 -> 192.168.56.101:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 47.104.173.216:9876 -> 192.168.56.101:49162	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 47.104.173.216:9876 -> 192.168.56.101:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 11, 2024, 2:25 p.m.			0	0
IsDebuggerPresent Aug. 11, 2024, 2:25 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c60760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c60760 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c607a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c607a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c607e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c607e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 11, 2024, 2:25 p.m.		1	1	0

One or more processes crashed (50 out of 934 events)

Time & API	Arguments	Status
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: sthealthclient+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4367324 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 4	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29769	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29737	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29705	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29673	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29641	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29609	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29577	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29545	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29513	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29481	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29449	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29417	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29385	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29353	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29321	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29289	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29257	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29225	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29193	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29161	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29129	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29097	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29065	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29033	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 29001	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28969	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28937	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28905	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28873	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28841	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28809	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28777	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28745	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28713	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28681	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28649	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28617	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28585	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28553	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28521	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28489	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28457	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28425	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28393	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28361	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4554720 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28329	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4558816 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28297	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4562912 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28265	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: sthealthclient+0xf054 @ 0x40f054 sthealthclient+0xf0a0 @ 0x40f0a0 sthealthclient+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: sthealthclient+0xeff0 exception.address: 0x40eff0 exception.module: sthealthclient.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4567008 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 126 registers.ebx: 0 registers.esi: 36962336 registers.ecx: 28233	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0227b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02277000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02275000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02266000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02267000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735d4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x053ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05691000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\STHealthUpdate.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\STHealthUpdate.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 11, 2024, 2:25 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x003a7c00', u'virtual_address': u'0x00026000', u'entropy': 7.999389875748088, u'name': u'.rsrc', u'virtual_size': u'0x003a7a4c'}

entropy

7.99938987575

description

A section with a high entropy has been found

entropy

0.965188241362

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 11, 2024, 2:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

47.104.173.216

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 11, 2024, 2:25 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

sthealthclient.exe tried to sleep 5456387 seconds, actually delayed analysis time by 5456387 seconds

Generates some ICMP traffic

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.wc
ALYac	Trojan.GenericKD.72943166
Cylance	Unsafe
VIPRE	Trojan.GenericKD.72943166
Sangfor	Trojan.Win32.Save.a
BitDefender	Trojan.GenericKD.72943166
Arcabit	Trojan.Generic.D459063E
VirIT	Trojan.Win32.Genus.VUC
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.IONAFLT
APEX	Malicious
McAfee	Artemis!5A49DFB1F848
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
MicroWorld-eScan	Trojan.GenericKD.72943166
Emsisoft	Trojan.GenericKD.72943166 (B)
TrendMicro	TrojanSpy.Win32.REDLINE.YXEE3Z
McAfeeD	ti!61EA68229965
FireEye	Generic.mg.5a49dfb1f8484d86
Sophos	Mal/Generic-S
Ikarus	Packed.Win32.Crypt
Google	Detected
MAX	malware (ai score=84)
Kingsoft	MSIL.Trojan.Crypt.gen
Gridinsoft	Trojan.Win32.Stealer.sa
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.72943166
BitDefenderTheta	Gen:NN.ZexaF.36806.Yt0@aeRh1Jd
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.Stealer
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEE3Z
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.11716371.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml
alibabacloud	Trojan:Win/Generik.IPSO8OG

sthealthclient.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All