Summary

Category	Machine	Started	Completed
ARCHIVE	s1_win7_x6401	Aug. 18, 2024, 9:49 a.m.	Aug. 18, 2024, 9:51 a.m.

Archive eagleget-2-1-6-50.exe @ eagleget-2-1-6-50.zip

Size	10.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e96dd956bc2159ff1d073876ef5d4e58`
SHA1	`a0da0d7c8394d646eb5a0f64be14397235f22704`
SHA256	`14636b7fc900e2be3fee5abb409e3b7a3cdf5a99107bf6d7dcbcce4b26ee0d34`
SHA512	`c2334b9c666174d38213c1cd84a8f2f9fbfbeea8e18f7fdf7e0b6bab70377e7d1a8f01fe45688bcbfcc2bb85933aa97a829c1feb94ede874b1426dd320080806`
CRC32	`32649112`
ssdeep	`196608:Mem6/gb2N3s9m35DylYLan8CmD5zpX9o38vR/dnG0sb9iMly9ssSGz8EQgCPhtv:MelYyVYm3RLaQ5zpNq8NdnExiMw+P4QD`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

eagleget-2-1-6-50.exe "C:\Users\test22\AppData\Local\Temp\eagleget-2-1-6-50.exe"
2540
- eagleget-2-1-6-50.tmp "C:\Users\test22\AppData\Local\Temp\is-90AKC.tmp\eagleget-2-1-6-50.tmp" /SL5="$80178,9993427,175104,C:\Users\test22\AppData\Local\Temp\eagleget-2-1-6-50.exe"
  2596
  - taskkill.exe "taskkill.exe" /f /im "net_updater32.exe"
    2724
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 18, 2024, 9:49 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 18, 2024, 9:49 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 18, 2024, 9:49 a.m.	buffer: ERROR: The process "net_updater32.exe" not found. console_handle: 0x0000000b	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 18, 2024, 9:49 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 110592 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73282000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73282000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:49 a.m.	process_identifier: 2596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 18, 2024, 9:50 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Foreign language identified in PE resource (8 events)

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0002bbc8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0002bbc8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0002bbc8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0002bbc8

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0002bbc8

size

0x00000468

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00034f10

size

0x0000004c

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00034f5c

size

0x00000488

name

RT_MANIFEST

language

LANG_CHINESE

filetype

XML 1.0 document, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000353e4

size

0x000005a4

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\CallbackCtrl.dll
file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\util.dll
file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\botva2.dll

Drops an executable to the user AppData folder (5 events)

file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\util.dll
file	C:\Users\test22\AppData\Local\Temp\is-90AKC.tmp\eagleget-2-1-6-50.tmp
file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\botva2.dll
file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\is-GKAV7.tmp\CallbackCtrl.dll

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "net_updater32.exe")

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 18, 2024, 9:49 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 428 events)

url	http://www.expedia.com/favicon.ico
url	http://uk.ask.com/favicon.ico
url	http://www.priceminister.com/
url	http://ru.wikipedia.org/
url	http://www.merlin.com.pl/favicon.ico
url	http://www.cnet.com/favicon.ico
url	http://search.nifty.com/
url	http://ns.adobe.com/exif/1.0/
url	http://www.etmall.com.tw/
url	http://search.goo.ne.jp/
url	http://fr.wikipedia.org/favicon.ico
url	http://busca.estadao.com.br/favicon.ico
url	http://search.hanafos.com/favicon.ico
url	http://search.chol.com/favicon.ico
url	http://purl.org/rss/1.0/
url	http://www.microsoft.com/WindowsMedia/Services/2003/10/10/games
url	http://amazon.fr/
url	http://www.amazon.co.jp/
url	http://www.mtv.com/favicon.ico
url	http://busqueda.aol.com.mx/
url	http://search.live.com/results.aspx?FORM=SOLTDF
url	http://msdn.microsoft.com/
url	http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)
url	http://www.sify.com/favicon.ico
url	http://yellowpages.superpages.com/
url	http://suche.freenet.de/
url	http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson
url	http://search.aol.com/
url	http://browse.guardian.co.uk/
url	http://www.mercadolibre.com.mx/
url	http://www.asharqalawsat.com/
url	http://www.facebook.com/
url	http://si.wikipedia.org/favicon.ico
url	http://www.rtl.de/favicon.ico
url	http://search.msn.com/results.aspx?q=
url	http://www.microsoft.com/pki/certs/MicrosoftWinPCA.crt0
url	http://search.naver.com/favicon.ico
url	http://en.wikipedia.org/favicon.ico
url	http://si.wikipedia.org/w/api.php?action=opensearch
url	http://udn.com/favicon.ico
url	http://rover.ebay.com
url	http://search.ebay.fr/
url	http://www.univision.com/
url	http://pt.wikipedia.org/w/api.php?action=opensearch
url	http://it.wikipedia.org/favicon.ico
url	http://uk.ask.com/
url	http://www.google.co.uk/
url	http://cnweb.search.live.com/results.aspx?q=
url	http://www.google.cz/
url	http://www.google.co.jp/

Yara rule detected in process memory (50 out of 129 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Hijack network configuration	rule	Hijack_Network
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Aug. 18, 2024, 9:49 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{F6D8142A-B30B-454B-9EE0-08A7B997DFE4}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F6D8142A-B30B-454B-9EE0-08A7B997DFE4}_is1		2	0
RegOpenKeyExW Aug. 18, 2024, 9:49 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{F6D8142A-B30B-454B-9EE0-08A7B997DFE4}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F6D8142A-B30B-454B-9EE0-08A7B997DFE4}_is1		2	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"taskkill.exe" /f /im "net_updater32.exe"

Archive eagleget-2-1-6-50.exe @ eagleget-2-1-6-50.zip

Summary

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All