Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 28, 2024, 10:17 a.m.	Oct. 28, 2024, 10:19 a.m.

Size	1.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`921b0badeaffee860310e6755769337e`
SHA256	`c9914b4ab252e782b73ab0a3efad386444ba8a8059167adcb0675968da2df36f`
CRC32	`FEB5471E`
ssdeep	`24576:KNFxrUgNQWcPb72kXGWjVcwBlTd8DKT/VSMsCdTzHpgaym9:KNFxogmf2scG1Tzcm9`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Save
2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
2156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
1188
- netsh.exe netsh wlan show profiles
  2240
- powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal
  2704
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.215.113.217	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 28, 2024, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2024, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2024, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2024, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 28, 2024, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 28, 2024, 10:17 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 28, 2024, 10:17 a.m.			0	0
IsDebuggerPresent Oct. 28, 2024, 10:17 a.m.			0	0
IsDebuggerPresent Oct. 28, 2024, 10:17 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000334d30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bebe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bebe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bebe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bee80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bee80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003befd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bec50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bf5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a55c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a55c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a5400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003a5400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b522890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b522890 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b522cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b522cf0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000334b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000334b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000334b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 28, 2024, 10:17 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000334b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 28, 2024, 10:17 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743d4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743d4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740d5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74442000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002480000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2491000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef270f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2710000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2710000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2710000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2710000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2710000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 28, 2024, 10:17 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2711000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (12 events)

Time & API	Arguments	Status	Return
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: mobsync.exe process_identifier: 1676	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: pw.exe process_identifier: 760	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: taskhost.exe process_identifier: 2004	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: wsqmcons.exe process_identifier: 1540	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: sdclt.exe process_identifier: 508	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: cmd.exe process_identifier: 940	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: SearchFilterHost.exe process_identifier: 1712	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x00000190 process_name: pw.exe process_identifier: 1076	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x000004b0 process_name: svchost.exe process_identifier: 2508	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x000004b0 process_name: mscorsvw.exe process_identifier: 2536	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x000004b0 process_name: mscorsvw.exe process_identifier: 2576	1	1
Process32NextW Oct. 28, 2024, 10:17 a.m.	snapshot_handle: 0x000004b0 process_name: sppsvc.exe process_identifier: 2628	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 28, 2024, 10:17 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh wlan show profiles

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.217

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (9 events)

file	C:\Windows\System32\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office15\.purple\accounts.xml
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\.purple\accounts.xml

Harvests credentials from local email clients (3 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.215.113.217:80

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Lazy.492566
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.492566
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Lazy.492566
K7GW	Trojan-Downloader ( 005a0ec91 )
K7AntiVirus	Trojan-Downloader ( 005a0ec91 )
Arcabit	Trojan.Lazy.D78416
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
Avast	Win32:BotX-gen [Trj]
ClamAV	Win.Keylogger.Zusy-10017136-0
Kaspersky	VHO:Trojan-Spy.Win32.Convagent.gen
MicroWorld-eScan	Gen:Variant.Lazy.492566
Emsisoft	Gen:Variant.Lazy.492566 (B)
F-Secure	Heuristic.HEUR/AGEN.1374093
CTX	dll.unknown.lazy
Sophos	Troj/Steal-DCI
FireEye	Generic.mg.921b0badeaffee86
Google	Detected
Avira	HEUR/AGEN.1374093
ZoneAlarm	VHO:Trojan-Spy.Win32.Convagent.gen
GData	Gen:Variant.Lazy.492566
AhnLab-V3	Trojan/Win.Generic.C5684584
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.4291765326
Ikarus	Trojan-PSW.Agent
Panda	Trj/Genetic.gen
huorong	TrojanSpy/Stealer.hk
AVG	Win32:BotX-gen [Trj]

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All