Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 19, 2024, 2:08 p.m.	Aug. 19, 2024, 3:51 p.m.

Size	6.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a14e062d5ddb947dd490cd3956c7de8a`
SHA256	`6ccb73967f66acd2af71b4d41a7b5f3755f04d1adba41bafc573f8c1cc14c26a`
CRC32	`34CE4986`
ssdeep	`49152:mVYXpGY8n5aL8P4hH4lhGtNfVkiC9H+xeUpw16cXqSOgvB6OGcP4NBgF5WIWPVv6:cu84hYlUfVkoSOgJRGcPMvOVHVKD3e`
PDB Path	Botsoft.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

66bdbedbc9eb9_ipfr.exe "C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe"
1720

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 19, 2024, 2:08 p.m.			0	0
IsDebuggerPresent Aug. 19, 2024, 2:08 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

Botsoft.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 19, 2024, 2:08 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f2e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f2f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 1720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x005d6600', u'virtual_address': u'0x00002000', u'entropy': 6.82893077353238, u'name': u'.text', u'virtual_size': u'0x005d6444'}

entropy

6.82893077353

description

A section with a high entropy has been found

entropy

0.983464955577

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 19, 2024, 2:08 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2076 process_handle: 0x00000250
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2076 process_handle: 0x00000250	1
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2112 process_handle: 0x00000258
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2112 process_handle: 0x00000258	1
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2148 process_handle: 0x00000260
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2148 process_handle: 0x00000260	1
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2184 process_handle: 0x00000268
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2184 process_handle: 0x00000268	1
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2220 process_handle: 0x00000270
NtTerminateProcess Aug. 19, 2024, 2:08 p.m.	status_code: 0xffffffff process_identifier: 2220 process_handle: 0x00000270	1

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 7b78a0f01fe5d526c4f38f9654b29ecb90ed3a8d
buffer	Buffer with sha1: 9f1b49877a0116891395c1a4bf166343cd92d786
buffer	Buffer with sha1: 31a7833396d6c401cc0a673765206b383f82844c

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2076 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000248	3221225496
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2112 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c	3221225496
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2148 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	3221225496
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2184 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c	3221225496
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2220 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1720 manipulating memory of non-child process 2076
Process injection	Process 1720 manipulating memory of non-child process 2112
Process injection	Process 1720 manipulating memory of non-child process 2148
Process injection	Process 1720 manipulating memory of non-child process 2184
Process injection	Process 1720 manipulating memory of non-child process 2220
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2076 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000248	3221225496	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2112 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c	3221225496	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2148 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	3221225496	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2184 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c	3221225496	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2220 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	3221225496	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1720	1	0
NtResumeThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1720	1	0
NtResumeThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 1720	1	0
CreateProcessInternalW Aug. 19, 2024, 2:08 p.m.	thread_identifier: 2080 thread_handle: 0x00000244 process_identifier: 2076 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000248	1	1
NtGetContextThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000244	1	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2076 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000248		3221225496
CreateProcessInternalW Aug. 19, 2024, 2:08 p.m.	thread_identifier: 2116 thread_handle: 0x00000250 process_identifier: 2112 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000024c	1	1
NtGetContextThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000250	1	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2112 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000024c		3221225496
CreateProcessInternalW Aug. 19, 2024, 2:08 p.m.	thread_identifier: 2152 thread_handle: 0x00000258 process_identifier: 2148 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000254	1	1
NtGetContextThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000258	1	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2148 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254		3221225496
CreateProcessInternalW Aug. 19, 2024, 2:08 p.m.	thread_identifier: 2188 thread_handle: 0x00000260 process_identifier: 2184 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000025c	1	1
NtGetContextThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000260	1	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2184 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c		3221225496
CreateProcessInternalW Aug. 19, 2024, 2:08 p.m.	thread_identifier: 2224 thread_handle: 0x00000268 process_identifier: 2220 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\66bdbedbc9eb9_ipfr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000264	1	1
NtGetContextThread Aug. 19, 2024, 2:08 p.m.	thread_handle: 0x00000268	1	0
NtAllocateVirtualMemory Aug. 19, 2024, 2:08 p.m.	process_identifier: 2220 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264		3221225496

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.m7QV
Elastic	malicious (high confidence)
Skyhigh	Artemis!Trojan
McAfee	Artemis!A14E062D5DDB
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73848376
Sangfor	Trojan.Msil.Kryptik.Vdjd
K7AntiVirus	Trojan ( 005ab9a71 )
BitDefender	Trojan.GenericKD.73848376
K7GW	Trojan ( 005ab9a71 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AJQV
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.Malwarex-10033462-0
Kaspersky	HEUR:Trojan-PSW.MSIL.RisePro.gen
Alibaba	Trojan:MSIL/Kryptik.ed540259
MicroWorld-eScan	Trojan.GenericKD.73848376
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:/M6YjS5GpfpKh1dR5PUHOA)
Emsisoft	Trojan.GenericKD.73848376 (B)
F-Secure	Trojan.TR/AD.Nekark.liwbj
TrendMicro	Trojan.Win32.PRIVATELOADER.YXEHOZ
McAfeeD	ti!6CCB73967F66
FireEye	Trojan.GenericKD.73848376
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/AD.Nekark.liwbj
MAX	malware (ai score=80)
Antiy-AVL	Trojan[PSW]/MSIL.RisePro
Kingsoft	MSIL.Trojan-PSW.RisePro.gen
Gridinsoft	Ransom.Win32.Wacatac.cl
Microsoft	Trojan:Win32/Phonzy.A!ml
ZoneAlarm	HEUR:Trojan-PSW.MSIL.RisePro.gen
GData	Trojan.GenericKD.73848376
Varist	W32/MSIL_Kryptik.LEN.gen!Eldorado
BitDefenderTheta	Gen:NN.ZemsilCO.36812.@t2@amXfHUp
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL.Generic
Ikarus	Trojan.MSIL.Crypt
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.PRIVATELOADER.YXEHOZ
Tencent	Malware.Win32.Gencirc.141667d9
Fortinet	MSIL/Kryptik.ALRL!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
alibabacloud	Trojan[stealer]:MSIL/Wacatac.B9nj

66bdbedbc9eb9_ipfr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All