popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

speechcarrierpro.exe

Emotet Gen1 .NET framework(MSIL) Malicious Library UPX AntiDebug PE64 PE File OS Processor Check .NET EXE PE32 CAB AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 16, 2024, 11:07 a.m. Oct. 16, 2024, 11:09 a.m.
Size 239.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 c022c9594435faedd2d06aa40d19c360
SHA256 f18a03b6d407d6f06862f983ea62a3f04dd9fb2759039365be66f05a9dc6620b
CRC32 586E55CB
ssdeep 6144:QahOfp0yN90QEFUNQs92GdPM3iCgLHmCpR:QiHy90TUNm8CgDmY
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
37.221.67.211 Active Moloch
5.189.218.177 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Waiting for 5
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: seconds, press a key to continue ...
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Waiting for 5
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: seconds, press a key to continue ...
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00677ca0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00677ca0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00704ae0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00704ae0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: f ¾ú"jãl¬ôVzJˆ/fZ· ä%Þ/øòÀþv'…
crypto_handle: 0x00704ae0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00704b60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00704b60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00704aa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00704aa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: f ¾ú"jãl¬ôVzJˆ/fZ· ä%Þ/øòÀþv'…
crypto_handle: 0x00704aa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007afae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: f ~»b€6uýPՌßõŸà ËF«Þ÷YŸúùˆjkO
crypto_handle: 0x007afae8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007afee8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007afee8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007afe68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path wextract.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name AVI
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73f41194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73e12ba1
0x70787f7
0x7077189
mscorlib+0xd3689c @ 0x72f4689c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d92652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73da264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73da2e95
CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x73f2a6d8
CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x73f2a737
PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x73f0ec81
PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x73f0ed29
mscorlib+0x389e52 @ 0x72599e52
mscorlib+0x309c30 @ 0x72519c30
mscorlib+0x2f809f @ 0x7250809f
0x7077128
0x7076f84
0x7076c33
0x7076aa9
0x70761c3
mscorlib+0x2d5861 @ 0x724e5861
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d92652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73da264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73da2e95
DllGetClassObjectInternal+0x357ee CorDllMainForThunk-0x56d0d clr+0xfa867 @ 0x73e8a867
DllGetClassObjectInternal+0x358c6 CorDllMainForThunk-0x56c35 clr+0xfa93f @ 0x73e8a93f
PreBindAssemblyEx+0x107ff StrongNameSignatureVerification-0x174c clr+0x18836a @ 0x73f1836a
CreateHistoryReader+0x48031 PostErrorVA-0x120f2e clr+0x257876 @ 0x73fe7876
CreateAssemblyNameObject+0x27e00 GetMetaDataInternalInterface-0x1066f clr+0x55299 @ 0x73de5299
CreateAssemblyNameObject+0x27c6a GetMetaDataInternalInterface-0x10805 clr+0x55103 @ 0x73de5103
CreateAssemblyNameObject+0x27e4b GetMetaDataInternalInterface-0x10624 clr+0x552e4 @ 0x73de52e4
CoUninitializeEE+0x9986 CreateAssemblyNameObject-0x42cf clr+0x291ca @ 0x73db91ca
CoUninitializeEE+0x1270 CreateAssemblyNameObject-0xc9e5 clr+0x20ab4 @ 0x73db0ab4
CreateAssemblyNameObject+0x1f873 GetMetaDataInternalInterface-0x18bfc clr+0x4cd0c @ 0x73ddcd0c
CreateAssemblyNameObject+0x1fa4c GetMetaDataInternalInterface-0x18a23 clr+0x4cee5 @ 0x73ddcee5
sxsJitStartup-0x537c5 clrjit+0x10cf @ 0x73c410cf
sxsJitStartup-0x4f480 clrjit+0x5414 @ 0x73c45414
sxsJitStartup-0x52e34 clrjit+0x1a60 @ 0x73c41a60
sxsJitStartup-0x52c52 clrjit+0x1c42 @ 0x73c41c42
sxsJitStartup-0x52447 clrjit+0x244d @ 0x73c4244d
sxsJitStartup-0x50878 clrjit+0x401c @ 0x73c4401c
sxsJitStartup-0x50762 clrjit+0x4132 @ 0x73c44132
sxsJitStartup-0x50612 clrjit+0x4282 @ 0x73c44282
sxsJitStartup-0x502ff clrjit+0x4595 @ 0x73c44595
0x6411484
0x64119f2
0x64112f7
0x5f2a08f
CreateAssemblyNameObject+0x61d0 GetMetaDataInternalInterface-0x3229f clr+0x33669 @ 0x73dc3669
CreateAssemblyNameObject+0x6268 GetMetaDataInternalInterface-0x32207 clr+0x33701 @ 0x73dc3701
CreateAssemblyNameObject+0x62aa GetMetaDataInternalInterface-0x321c5 clr+0x33743 @ 0x73dc3743
CreateAssemblyNameObject+0x6503 GetMetaDataInternalInterface-0x31f6c clr+0x3399c @ 0x73dc399c
CreateAssemblyNameObject+0x5ffd GetMetaDataInternalInterface-0x32472 clr+0x33496 @ 0x73dc3496
CreateAssemblyNameObject+0x6c42 GetMetaDataInternalInterface-0x3182d clr+0x340db @ 0x73dc40db
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73dabcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73d92ae9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d92652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73da264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73e11838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73e11737
mscorlib+0x2d3711 @ 0x724e3711
mscorlib+0x308f2d @ 0x72518f2d
mscorlib+0x3133fd @ 0x725233fd
mscorlib+0x9873b1 @ 0x72b973b1

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7588b727
registers.esp: 3902840
registers.edi: 0
registers.eax: 3902840
registers.ebp: 3902920
registers.edx: 0
registers.ebx: 6561080
registers.esi: 6578944
registers.ecx: 135490964
1 0 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://37.221.67.211/direct/Mfrngcojt.mp4
request GET http://37.221.67.211/direct/Mfrngcojt.mp4
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00860000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00970000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d92000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00541000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00543000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x774d0000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef30000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef20000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00971000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00972000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00973000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05f2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00974000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06401000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0640d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05f2d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0640e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0640f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06046000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0604c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06049000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06410000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06411000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05f2a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06520000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\speechcarrier.exe
cmdline "C:\Windows\System32\cmd.exe" /c timeout 5
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\speechcarrier.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c timeout 5
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c timeout 5
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1728512
protection: 16 (PAGE_EXECUTE)
base_address: 0x06b00000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 1158
family: 0
1 0 0
section {u'size_of_data': u'0x00030c00', u'virtual_address': u'0x0000f000', u'entropy': 7.541739369856776, u'name': u'.rsrc', u'virtual_size': u'0x00031000'} entropy 7.54173936986 description A section with a high entropy has been found
entropy 0.819327731092 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2212
process_handle: 0x00000768
0 0
buffer Buffer with sha1: 702137e7dcc309c93aefde2f05ebd9bb85ab6bcd
host 37.221.67.211
host 5.189.218.177
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2160
region_size: 876544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003d8
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description speechcarrier.exe tried to sleep 2728198 seconds, actually delayed analysis time by 2728198 seconds
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELâ4̾à" 0ð F/ @ ` @…ô.O t@ Ø.  H.text€ï ð  `.rsrct ò @@.reloc @ ø @B
base_address: 0x00400000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer:  €P€8€€h€t ää4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°DStringFileInfo 000004b0Comments"CompanyName*FileDescription0FileVersion1.0.0.0@InternalNameBzhqyjztmiy.exe&LegalCopyright*LegalTrademarksHOriginalFilenameBzhqyjztmiy.exe"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0„# ê<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x004d2000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer: H?
base_address: 0x004d4000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2160
process_handle: 0x000003d8
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELâ4̾à" 0ð F/ @ ` @…ô.O t@ Ø.  H.text€ï ð  `.rsrct ò @@.reloc @ ø @B
base_address: 0x00400000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0
Process injection Process 2212 called NtSetContextThread to modify thread in remote process 2160
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4206406
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000768
process_identifier: 2160
1 0 0
Process injection Process 2212 resumed a thread in remote process 2160
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000768
suspend_count: 1
process_identifier: 2160
1 0 0
dead_host 5.189.218.177:2000
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2208
thread_handle: 0x000000000000000c
process_identifier: 2212
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\speechcarrier.exe
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
inherit_handles: 0
process_handle: 0x0000000000000060
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x0000020c
suspend_count: 1
process_identifier: 2212
1 0 0

CreateProcessInternalW

 thread_identifier: 2276
thread_handle: 0x000003b4
process_identifier: 2292
current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c timeout 5
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003bc
1 1 0

NtResumeThread

 thread_handle: 0x00000504
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000518
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000534
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000578
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x0000058c
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x000005ac
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x0000020c
suspend_count: 1
process_identifier: 2212
1 0 0

CreateProcessInternalW

 thread_identifier: 2244
thread_handle: 0x00000404
process_identifier: 2480
current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c timeout 5
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000244
1 1 0

NtResumeThread

 thread_handle: 0x000004e4
suspend_count: 1
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x00000768
suspend_count: 1
process_identifier: 2212
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtSetContextThread

 registers.eip: 1944136580
registers.esp: 3903048
registers.edi: 3904708
registers.eax: 345
registers.ebp: 3904716
registers.edx: 31
registers.ebx: 3904964
registers.esi: 39502876
registers.ecx: 42390664
thread_handle: 0x000000e0
process_identifier: 2212
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2212
1 0 0

CreateProcessInternalW

 thread_identifier: 156
thread_handle: 0x00000768
process_identifier: 2160
current_directory: C:\Windows\Microsoft.NET\Framework\v4.0.30319
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000003d8
1 1 0

NtGetContextThread

 thread_handle: 0x00000768
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2160
region_size: 876544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003d8
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELâ4̾à" 0ð F/ @ ` @…ô.O t@ Ø.  H.text€ï ð  `.rsrct ò @@.reloc @ ø @B
base_address: 0x00400000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer:  €P€8€€h€t ää4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°DStringFileInfo 000004b0Comments"CompanyName*FileDescription0FileVersion1.0.0.0@InternalNameBzhqyjztmiy.exe&LegalCopyright*LegalTrademarksHOriginalFilenameBzhqyjztmiy.exe"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0„# ê<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x004d2000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer: H?
base_address: 0x004d4000
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2160
process_handle: 0x000003d8
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4206406
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000768
process_identifier: 2160
1 0 0

NtResumeThread

 thread_handle: 0x00000768
suspend_count: 1
process_identifier: 2160
1 0 0

CreateProcessInternalW

 thread_identifier: 2332
thread_handle: 0x00000084
process_identifier: 296
current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP
filepath: C:\Windows\System32\timeout.exe
track: 1
command_line: timeout 5
filepath_r: C:\Windows\system32\timeout.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

CreateProcessInternalW

 thread_identifier: 2528
thread_handle: 0x00000084
process_identifier: 284
current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP
filepath: C:\Windows\System32\timeout.exe
track: 1
command_line: timeout 5
filepath_r: C:\Windows\system32\timeout.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2160
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2160
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2160
1 0 0

NtResumeThread

 thread_handle: 0x0000022c
suspend_count: 1
process_identifier: 2160
1 0 0
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.NanoBot.m!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
CAT-QuickHeal Backdoor.MSIL
Skyhigh BehavesLike.Win64.AgentTesla.dc
ALYac Trojan.Generic.36704488
Cylance Unsafe
VIPRE Trojan.Generic.36704488
Sangfor Downloader.Msil.Nanobot.V1at
K7AntiVirus Trojan-Downloader ( 005b87f51 )
BitDefender Trojan.Generic.36704488
K7GW Trojan-Downloader ( 005b87f51 )
VirIT Trojan.Win32.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.RAM
APEX Malicious
McAfee Artemis!C022C9594435
Avast Win32:DropperX-gen [Drp]
Kaspersky UDS:Backdoor.MSIL.NanoBot.gen
Alibaba Backdoor:MSIL/NanoBot.07fb0771
MicroWorld-eScan Trojan.Generic.36704488
Rising Backdoor.NanoBot!8.28C (CLOUD)
Emsisoft Trojan.Generic.36704488 (B)
F-Secure Trojan.TR/Dldr.Agent.bxexq
TrendMicro TROJ_GEN.R03BC0DHA24
McAfeeD ti!F18A03B6D407
FireEye Trojan.Generic.36704488
Sophos Mal/Generic-S
Google Detected
Avira TR/Dldr.Agent.bxexq
MAX malware (ai score=80)
Antiy-AVL Trojan[Backdoor]/MSIL.NanoBot
Gridinsoft Trojan.Win64.Downloader.sa
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm UDS:Backdoor.MSIL.NanoBot.gen
GData MSIL.Trojan-Downloader.Agent.BQR
Varist W32/MSIL_Kryptik.KHG.gen!Eldorado
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware/Suspicious
Ikarus Trojan.MSIL.Inject
Panda Trj/Chgt.AD
Tencent Malware.Win32.Gencirc.14153c9b
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.RAM!tr.dldr
AVG Win32:DropperX-gen [Drp]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (W)
alibabacloud Trojan[downloader]:MSIL/NanoBot.gyf