Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 30, 2024, 11:22 a.m.	Sept. 30, 2024, 11:25 a.m.

Size	840.0KB
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`9b73c82d8f0e6cae3bce7b2fc98b3383`
SHA256	`795778587d86ee3aa3d2f628e8d3994b8735c5528413b4298afac8b6a683aefb`
CRC32	`C70D3D27`
ssdeep	`24576:5st4JVMa25rIlp/sMHlzU0+oIkxcwLkwz:5Z7Ma2QZ5HlzU0+o+y`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,DllInstall
3016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,DllUpdate
2216
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,InitDll
2268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,ThreadFunction
2364
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,curl_easy_cleanup
1588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,curl_easy_init
1324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,curl_easy_perform
2124
explorer.exe C:\Windows\Explorer.EXE
1236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,curl_easy_setopt
2688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.exe.dll,
2776

Name	Response	Post-Analysis Lookup
seburage.com	A 194.67.193.73	194.67.193.73
banydox.com	A 194.67.193.74	194.67.193.74

IP Address	Status	Action
164.124.101.2	Active	Moloch
194.67.193.73	Active	Moloch
194.67.193.74	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49173 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.73:443 -> 192.168.56.102:49177	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49181 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49180 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49170 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49182 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49190 -> 194.67.193.74:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49183 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.73:443 -> 192.168.56.102:49176	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 194.67.193.73:443 -> 192.168.56.102:49186	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49191 -> 194.67.193.74:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49174 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 194.67.193.73:443 -> 192.168.56.102:49185	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 194.67.193.74:443 -> 192.168.56.102:49192	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49171 -> 194.67.193.73:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0
IsDebuggerPresent Sept. 30, 2024, 11:21 a.m.			0	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 30, 2024, 11:21 a.m.	stacktrace: DllInstall+0x7200 InitDll-0x14b0 useraccount+0x5a690 @ 0x73a3a690 rundll32+0x137d @ 0x9b137d rundll32+0x1326 @ 0x9b1326 rundll32+0x1901 @ 0x9b1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: f3 a5 0f b6 05 63 30 aa 73 85 c0 75 14 33 c9 c7 exception.instruction: movsd dword ptr es:[edi], dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: DllInstall-0x2b07f useraccount+0x28411 exception.address: 0x73a08411 registers.esp: 2878664 registers.edi: 2878676 registers.eax: 1048584 registers.ebp: 2880524 registers.edx: 0 registers.ebx: 4294967295 registers.esi: 0 registers.ecx: 16	1	0	0
__exception__ Sept. 30, 2024, 11:21 a.m.	stacktrace: New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x74397747 CreateProcessW+0x2c CreateProcessA-0x9 kernel32+0x11069 @ 0x74e81069 GetHookAPIs-0x37ddc aclayers+0x1266d @ 0x7464266d curl_easy_cleanup+0x40f curl_easy_init-0x9b1 useraccount+0x6332f @ 0x73a4332f rundll32+0x137d @ 0x9b137d rundll32+0x1326 @ 0x9b1326 rundll32+0x1901 @ 0x9b1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: 66 89 08 39 9d 7c fc ff ff 0f 85 ff 3a 01 00 8d exception.symbol: RegisterApplicationRestart+0x25f DeleteFiber-0xd7 kernel32+0x3b79b exception.instruction: mov word ptr [eax], cx exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 243611 exception.address: 0x74eab79b registers.esp: 1306288 registers.edi: 1940371034 registers.eax: 1940371034 registers.ebp: 1307892 registers.edx: 5978676 registers.ebx: 0 registers.esi: 32 registers.ecx: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 88 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74310000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74221000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74222000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x753a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74041000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73841000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74310000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74221000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74222000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74310000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74221000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74222000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74310000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74221000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74222000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x753a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74041000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 11:21 a.m.	process_identifier: 1588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a7b000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000fa00', u'virtual_address': u'0x004b6000', u'entropy': 6.839277008288167, u'name': u'.reloc', u'virtual_size': u'0x0000f9bc'}

entropy

6.83927700829

description

A section with a high entropy has been found

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.Common.77364737
Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 100)
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.74124260
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74124260
Sangfor	Downloader.Win32.Agent.Vxgw
BitDefender	Trojan.GenericKD.74124260
K7GW	Trojan-Downloader ( 005b37881 )
K7AntiVirus	Trojan-Downloader ( 005b37881 )
Arcabit	Trojan.Generic.D46B0BE4
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Matanbuchus
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.HOR
Avast	Win32:DropperX-gen [Drp]
Alibaba	TrojanDownloader:Win32/DropperX.78591d03
MicroWorld-eScan	Trojan.GenericKD.74124260
Emsisoft	Trojan.GenericKD.74124260 (B)
F-Secure	Trojan.TR/AVI.Agent.wiclm
TrendMicro	Trojan.Win32.MATANBUCHUS.YXEIDZ
McAfeeD	ti!795778587D86
CTX	dll.trojan.generic
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.9b73c82d8f0e6cae
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/AVI.Agent.wiclm
Antiy-AVL	Trojan/Win32.Agent
Xcitium	Malware@#1ii52gohnvh6q
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.74124260
Varist	W32/ABTrojan.GRGG-3324
AhnLab-V3	Dropper/Win.Generic.C5669950
McAfee	Artemis!9B73C82D8F0E
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Downloader
Ikarus	Trojan-Downloader.Win32.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.MATANBUCHUS.YXEIDZ
Tencent	Malware.Win32.Gencirc.1418d618
huorong	Trojan/Agent.bwb
MaxSecure	Trojan.Malware.278902681.susgen
Fortinet	W32/Agent.HOR!tr.dldr
AVG	Win32:DropperX-gen [Drp]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:Win/Wacatac.B9nj

useraccount.aspx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All