Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 21, 2024, 1:36 p.m.	Oct. 21, 2024, 1:54 p.m.

Size	314.0KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ff5afed0a8b802d74af1c1422c720446`
SHA256	`17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10`
CRC32	`604DE03B`
ssdeep	`6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8`
PDB Path	c:\35h7rnz\obj\Release\' .pdb
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) IsPE32 - (no description)

MK.exe "C:\Users\test22\AppData\Local\Temp\MK.exe"
1692
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2076

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
89.105.223.196	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 21, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Oct. 21, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Oct. 21, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Oct. 21, 2024, 1:36 p.m.			0	0

Command line console output was observed (50 out of 102 events)

Time & API	Arguments	Status	Return
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 0 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 1 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 2 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 3 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 4 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 5 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 6 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 7 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 8 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 9 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 10 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 11 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 12 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 13 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 14 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 15 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 16 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 17 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 18 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 19 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 20 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 21 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 22 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 23 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 24 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 25 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 26 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 27 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 28 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 29 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 30 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 31 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 32 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 33 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 34 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 35 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 36 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 37 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 38 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 39 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 40 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 41 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 42 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 43 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 44 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 45 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 46 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 47 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 48 console_handle: 0x00000007	1	1
WriteConsoleA Oct. 21, 2024, 1:36 p.m.	buffer: Person 49 console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057d068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057d068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057d068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057d068 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057d0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057d0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057cfe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057cfe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057cfe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057cfe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0057cfe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x057891c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x057891c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 21, 2024, 1:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05789188 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

c:\35h7rnz\obj\Release\' .pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 21, 2024, 1:36 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 71 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 1692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73daa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c9f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7274e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7123b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00851000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x710f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x710b1000 process_handle: 0xffffffff	1

Creates hidden or system file (4 events)

Time & API	Arguments	Return
NtCreateFile Oct. 21, 2024, 1:36 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Oct. 21, 2024, 1:36 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Oct. 21, 2024, 1:36 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Oct. 21, 2024, 1:36 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004dc00', u'virtual_address': u'0x00002000', u'entropy': 7.994735225546954, u'name': u'.text', u'virtual_size': u'0x0004db14'}

entropy

7.99473522555

description

A section with a high entropy has been found

entropy

0.992025518341

description

Overall entropy of this PE file is high

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

89.105.223.196

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000208	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Oct. 21, 2024, 1:36 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL\|s.Êà0ìÐbº @ @ºO ÌÉô¹ H.textHê ì `.rsrcÌÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2076 process_handle: 0x00000208	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: °d: base_address: 0x00450000 process_identifier: 2076 process_handle: 0x00000208	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2076 process_handle: 0x00000208	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL\|s.Êà0ìÐbº @ @ºO ÌÉô¹ H.textHê ì `.rsrcÌÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2076 process_handle: 0x00000208	1	1	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1692 called NtSetContextThread to modify thread in remote process 2076
NtSetContextThread Oct. 21, 2024, 1:36 p.m.	registers.eip: 2005598660 registers.esp: 3275592 registers.edi: 0 registers.eax: 4373090 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000204 process_identifier: 2076	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1692 resumed a thread in remote process 2076
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 2076	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

89.105.223.196:29862

Executed a process and injected code into it, probably while unpacking (19 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1692	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 1692	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1692	1	0
CreateProcessInternalW Oct. 21, 2024, 1:36 p.m.	thread_identifier: 2080 thread_handle: 0x00000204 process_identifier: 2076 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000208	1	1
NtGetContextThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000204	1	0
NtAllocateVirtualMemory Oct. 21, 2024, 1:36 p.m.	process_identifier: 2076 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000208	1	0
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL\|s.Êà0ìÐbº @ @ºO ÌÉô¹ H.textHê ì `.rsrcÌÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2076 process_handle: 0x00000208	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: base_address: 0x00402000 process_identifier: 2076 process_handle: 0x00000208	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: base_address: 0x00432000 process_identifier: 2076 process_handle: 0x00000208	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: °d: base_address: 0x00450000 process_identifier: 2076 process_handle: 0x00000208	1	1
WriteProcessMemory Oct. 21, 2024, 1:36 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2076 process_handle: 0x00000208	1	1
NtSetContextThread Oct. 21, 2024, 1:36 p.m.	registers.eip: 2005598660 registers.esp: 3275592 registers.edi: 0 registers.eax: 4373090 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000204 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000370 suspend_count: 1 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000384 suspend_count: 1 process_identifier: 2076	1	0
NtResumeThread Oct. 21, 2024, 1:36 p.m.	thread_handle: 0x00000384 suspend_count: 1 process_identifier: 2076	1	0

File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 events)

Bkav	W32.Common.9F1D5990
Lionic	Trojan.Win32.Cerbu.l!c
CAT-QuickHeal	TrojanSpy.MSIL
Skyhigh	BehavesLike.Win32.Generic.fc
ALYac	Trojan.GenericKD.74190572
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74190572
Sangfor	Infostealer.Msil.Kryptik.Vcwl
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Trojan.GenericKD.74190572
K7GW	Trojan ( 005ba5051 )
K7AntiVirus	Trojan ( 005ba5051 )
Arcabit	Trojan.Generic.D46C0EEC
VirIT	Trojan.Win32.GenusT.DZJI
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.HBNC
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Msilheracles-10036160-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
Alibaba	TrojanSpy:MSIL/Cerbu.fec2cfb2
NANO-Antivirus	Trojan.Win32.RedLineSteal.kskcam
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
MicroWorld-eScan	Trojan.GenericKD.74190572
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:Y8kpfem4sYZ084QasR9srg)
Emsisoft	Trojan.GenericKD.74190572 (B)
F-Secure	Trojan.TR/AD.RedLineSteal.nlqaj
DrWeb	Trojan.Siggen29.43132
Zillya	Trojan.GenKryptik.Win32.968541
TrendMicro	Trojan.Win32.AMADEY.YXEIQZ
McAfeeD	ti!17AC37B49465
CTX	exe.trojan.msil
Sophos	Mal/MSIL-WA
FireEye	Generic.mg.ff5afed0a8b802d7
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/AD.RedLineSteal.nlqaj
Kingsoft	MSIL.Trojan-Spy.Stealer.gen
Gridinsoft	Malware.Win32.RedLine.tr
Xcitium	Malware@#3e7jlyusna8g5
Microsoft	Trojan:MSIL/Cerbu.AMA!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	Trojan.GenericKD.74190572
Varist	W32/MSIL_Kryptik.LNK.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5670639
McAfee	Artemis!FF5AFED0A8B8
TACHYON	Trojan-Spy/W32.DN-InfoStealer.321536.E
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.MSIL

MK.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All