Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 9, 2024, 9:43 a.m.	Sept. 9, 2024, 9:50 a.m.

Size	313.0KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b8010780cbccba9ec2e20d7b3c17c6be`
SHA256	`49c25f225e9c5a3ffb651a2ede3505b0faccfbef4f43652d7321388ce6c4b864`
CRC32	`24A3E75C`
ssdeep	`6144:GwWRWpJv0YaCeIplG59br5OZ3p2GAbdZCHZnHUCy9X/qWCGGUJEqY3nfT5B/b6Bf:GwAWXx5eIplObs3peSHtHUCWX/qWvVYk`
PDB Path	c:\8xe399\obj\Release\' .pdb
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) IsPE32 - (no description)

66dcad8f5f33a_crypted.exe "C:\Users\test22\AppData\Local\Temp\66dcad8f5f33a_crypted.exe"
884
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2628

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
5.42.92.222	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 9, 2024, 9:43 a.m.			0	0
IsDebuggerPresent Sept. 9, 2024, 9:43 a.m.			0	0
IsDebuggerPresent Sept. 9, 2024, 9:44 a.m.			0	0
IsDebuggerPresent Sept. 9, 2024, 9:44 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fdf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fe78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fe78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fd78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fd78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fd78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fd78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0075fd78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007604f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007604f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 9, 2024, 9:44 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007606b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

c:\8xe399\obj\Release\' .pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 9, 2024, 9:43 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 67 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00900000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00862000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00895000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0089b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00897000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:43 a.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74642000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73522000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f1b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00615000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00617000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7478a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0060a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00607000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74691000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74081000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7467f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74651000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72afe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7297b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72881000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73df1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72841000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00606000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates hidden or system file (4 events)

Time & API	Arguments	Return
NtCreateFile Sept. 9, 2024, 9:44 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 9, 2024, 9:44 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 9, 2024, 9:44 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 9, 2024, 9:44 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004d800', u'virtual_address': u'0x00002000', u'entropy': 7.995826801041676, u'name': u'.text', u'virtual_size': u'0x0004d6b4'}

entropy

7.99582680104

description

A section with a high entropy has been found

entropy

0.992

description

Overall entropy of this PE file is high

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

5.42.92.222

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000204	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡)bà0ìÐº @ @À¹O ¼É¤¹ H.textøé ì `.rsrc¼É Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2628 process_handle: 0x00000204	1	1
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: °: base_address: 0x00450000 process_identifier: 2628 process_handle: 0x00000204	1	1
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2628 process_handle: 0x00000204	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡)bà0ìÐº @ @À¹O ¼É¤¹ H.textøé ì `.rsrc¼É Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2628 process_handle: 0x00000204	1	1	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 884 called NtSetContextThread to modify thread in remote process 2628
NtSetContextThread Sept. 9, 2024, 9:44 a.m.	registers.eip: 2005598660 registers.esp: 2293256 registers.edi: 0 registers.eax: 4373010 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000200 process_identifier: 2628	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 884 resumed a thread in remote process 2628
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2628	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

5.42.92.222:7880

Executed a process and injected code into it, probably while unpacking (20 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 9, 2024, 9:43 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 884	1	0
NtResumeThread Sept. 9, 2024, 9:43 a.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 884	1	0
NtResumeThread Sept. 9, 2024, 9:43 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 884	1	0
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 884	1	0
NtGetContextThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 884	1	0
CreateProcessInternalW Sept. 9, 2024, 9:44 a.m.	thread_identifier: 2632 thread_handle: 0x00000200 process_identifier: 2628 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000204	1	1
NtGetContextThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x00000200	1	0
NtAllocateVirtualMemory Sept. 9, 2024, 9:44 a.m.	process_identifier: 2628 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000204	1	0
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡)bà0ìÐº @ @À¹O ¼É¤¹ H.textøé ì `.rsrc¼É Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2628 process_handle: 0x00000204	1	1
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: base_address: 0x00402000 process_identifier: 2628 process_handle: 0x00000204	1	1
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: base_address: 0x00432000 process_identifier: 2628 process_handle: 0x00000204	1	1
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: °: base_address: 0x00450000 process_identifier: 2628 process_handle: 0x00000204	1	1
WriteProcessMemory Sept. 9, 2024, 9:44 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2628 process_handle: 0x00000204	1	1
NtSetContextThread Sept. 9, 2024, 9:44 a.m.	registers.eip: 2005598660 registers.esp: 2293256 registers.edi: 0 registers.eax: 4373010 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000200 process_identifier: 2628	1	0
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Sept. 9, 2024, 9:44 a.m.	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 2628	1	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stelpak.4!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.fc
ALYac	Gen:Variant.Lazy.589374
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.560451
Sangfor	Trojan.Msil.Zusy.Vj0n
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Gen:Variant.Zusy.560451
K7GW	Riskware ( 00584baa1 )
Arcabit	Trojan.Zusy.D88D43
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.HBJE
APEX	Malicious
Avast	Win32:CrypterX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Stelpak.gen
MicroWorld-eScan	Gen:Variant.Zusy.560451
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:B+UxP8lJaY5sa3TAX7wilg)
Emsisoft	Gen:Variant.Zusy.560451 (B)
F-Secure	Trojan.TR/AD.RedLineSteal.qqnef
DrWeb	Trojan.PWS.RedLineNET.9
McAfeeD	ti!49C25F225E9C
FireEye	Generic.mg.b8010780cbccba9e
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/AD.RedLineSteal.qqnef
MAX	malware (ai score=82)
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	Trojan:MSIL/RedlineStealer.RPY!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Stelpak.gen
GData	Gen:Variant.Zusy.560451
McAfee	Artemis!B8010780CBCC
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt
Ikarus	Trojan.MSIL.Krypt
huorong	Trojan/MSIL.Agent.li
Fortinet	W32/Malicious_Behavior.SBX
AVG	Win32:CrypterX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (D)

66dcad8f5f33a_crypted.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All