Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 13, 2024, 9:22 a.m.	Sept. 13, 2024, 9:25 a.m.

Size	840.0KB
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`9b73c82d8f0e6cae3bce7b2fc98b3383`
SHA256	`795778587d86ee3aa3d2f628e8d3994b8735c5528413b4298afac8b6a683aefb`
CRC32	`C70D3D27`
ssdeep	`24576:5st4JVMa25rIlp/sMHlzU0+oIkxcwLkwz:5Z7Ma2QZ5HlzU0+o+y`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,DllInstall
2564
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,DllUpdate
2648
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,InitDll
2740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,ThreadFunction
2832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_cleanup
2924
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_init
3024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_perform
2124
explorer.exe C:\Windows\Explorer.EXE
1452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_setopt
2452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,
2684

Name	Response	Post-Analysis Lookup
seburage.com	A 194.67.193.73	194.67.193.73
banydox.com	A 194.67.193.74	194.67.193.74

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.67.193.73	Active	Moloch
194.67.193.74	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49180 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49181 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.73:443 -> 192.168.56.101:49185	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 194.67.193.73:443 -> 192.168.56.101:49186	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49189 -> 194.67.193.74:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49190 -> 194.67.193.74:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49169 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.73:443 -> 192.168.56.101:49176	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49184 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.74:443 -> 192.168.56.101:49192	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49175 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.73:443 -> 192.168.56.101:49177	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49182 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 13, 2024, 9:23 a.m.	stacktrace: DllInstall+0x7200 InitDll-0x14b0 useraccount+0x5a690 @ 0x724fa690 rundll32+0x137d @ 0xec137d rundll32+0x1326 @ 0xec1326 rundll32+0x1901 @ 0xec1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f3 a5 0f b6 05 63 30 56 72 85 c0 75 14 33 c9 c7 exception.instruction: movsd dword ptr es:[edi], dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: DllInstall-0x2b07f useraccount+0x28411 exception.address: 0x724c8411 registers.esp: 1043120 registers.edi: 1043132 registers.eax: 1048584 registers.ebp: 1044980 registers.edx: 0 registers.ebx: 4294967295 registers.esi: 0 registers.ecx: 16	1	0	0
__exception__ Sept. 13, 2024, 9:22 a.m.	stacktrace: New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x736e7747 CreateProcessW+0x2c CreateProcessA-0x9 kernel32+0x11069 @ 0x755c1069 GetHookAPIs-0x37ddc aclayers+0x1266d @ 0x741a266d curl_easy_cleanup+0x40f curl_easy_init-0x9b1 useraccount+0x6332f @ 0x7250332f rundll32+0x137d @ 0xec137d rundll32+0x1326 @ 0xec1326 rundll32+0x1901 @ 0xec1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 66 89 08 39 9d 7c fc ff ff 0f 85 ff 3a 01 00 8d exception.symbol: RegisterApplicationRestart+0x25f DeleteFiber-0xd7 kernel32+0x3b79b exception.instruction: mov word ptr [eax], cx exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 243611 exception.address: 0x755eb79b registers.esp: 2225044 registers.edi: 1918088794 registers.eax: 1918088794 registers.ebp: 2226648 registers.edx: 4587896 registers.ebx: 0 registers.esi: 32 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 13, 2024, 9:23 a.m.

stacktrace:

DllInstall+0x7200 InitDll-0x14b0 useraccount+0x5a690 @ 0x724fa690
rundll32+0x137d @ 0xec137d
rundll32+0x1326 @ 0xec1326
rundll32+0x1901 @ 0xec1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: f3 a5 0f b6 05 63 30 56 72 85 c0 75 14 33 c9 c7
exception.instruction: movsd dword ptr es:[edi], dword ptr [esi]
exception.exception_code: 0xc0000005
exception.symbol: DllInstall-0x2b07f useraccount+0x28411
exception.address: 0x724c8411
registers.esp: 1043120
registers.edi: 1043132
registers.eax: 1048584
registers.ebp: 1044980
registers.edx: 0
registers.ebx: 4294967295
registers.esi: 0
registers.ecx: 16

__exception__

Sept. 13, 2024, 9:22 a.m.

stacktrace:

New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x736e7747
CreateProcessW+0x2c CreateProcessA-0x9 kernel32+0x11069 @ 0x755c1069
GetHookAPIs-0x37ddc aclayers+0x1266d @ 0x741a266d
curl_easy_cleanup+0x40f curl_easy_init-0x9b1 useraccount+0x6332f @ 0x7250332f
rundll32+0x137d @ 0xec137d
rundll32+0x1326 @ 0xec1326
rundll32+0x1901 @ 0xec1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 66 89 08 39 9d 7c fc ff ff 0f 85 ff 3a 01 00 8d
exception.symbol: RegisterApplicationRestart+0x25f DeleteFiber-0xd7 kernel32+0x3b79b
exception.instruction: mov word ptr [eax], cx
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 243611
exception.address: 0x755eb79b
registers.esp: 2225044
registers.edi: 1918088794
registers.eax: 1918088794
registers.ebp: 2226648
registers.edx: 4587896
registers.ebx: 0
registers.esi: 32
registers.ecx: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7253b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73584000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73471000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7253b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73584000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7253b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73584000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7253b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73584000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73471000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000fa00', u'virtual_address': u'0x004b6000', u'entropy': 6.839277008288167, u'name': u'.reloc', u'virtual_size': u'0x0000f9bc'}

entropy

6.83927700829

description

A section with a high entropy has been found

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Fragtor.633164
VIPRE	Gen:Variant.Fragtor.633164
Sangfor	Downloader.Win32.Fragtor.Vfk4
BitDefender	Gen:Variant.Fragtor.633164
K7GW	Trojan-Downloader ( 005b37881 )
Arcabit	Trojan.Fragtor.D9A94C
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Matanbuchus
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.HOR
Avast	Win32:TrojanX-gen [Trj]
Alibaba	TrojanDownloader:Win32/Generic.a31e357c
MicroWorld-eScan	Gen:Variant.Fragtor.633164
Rising	Trojan.ShellCodeLoader!1.F9AF (CLASSIC)
Emsisoft	Gen:Variant.Fragtor.633164 (B)
F-Secure	Trojan.TR/AVI.Agent.wiclm
BitDefenderTheta	Gen:NN.ZedlaF.36812.0q4@a4wTOKo
TrendMicro	Trojan.Win32.MATANBUCHUS.YXEIDZ
McAfeeD	ti!795778587D86
FireEye	Generic.mg.9b73c82d8f0e6cae
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/AVI.Agent.wiclm
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Win32.Agent
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Fragtor.633164
McAfee	Artemis!9B73C82D8F0E
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Downloader
Ikarus	Trojan-Downloader.Win32.Agent
TrendMicro-HouseCall	Trojan.Win32.MATANBUCHUS.YXEIDZ
Tencent	Malware.Win32.Gencirc.1418d618
Fortinet	W32/Agent.HOR!tr.dldr
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:Win/Wacatac.B9nj

useraccount.aspx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All