popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dnlib.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 11, 2024, 9:57 a.m. Nov. 11, 2024, 10:12 a.m.
Size 92.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 7b429fa791c946c645975b58cd0570dc
SHA256 ef24f34bd1bd9b772b42a458b11ab579ed8a51bce196ca00e1781c4b07bfc58f
CRC32 CAA4DFE8
ssdeep 1536:YIAZRAg70PNwqtL9xWsx0q0zLoK5bXz66CXvNkFYy7vNt0j2307X8EHF5:/AZRAgCwqJH0XzLV5bXu6HyybNt0je0F
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:57986 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:57986 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64530 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:50674 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 164.124.101.2:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic
UDP 192.168.56.103:57986 -> 8.8.8.8:53 2028681 ET POLICY DNS Query to DynDNS Domain *.hopto .org Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Microsoft Web Edge" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ok.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Microsoft\Windows\issas" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0xb107ed
0xb10673
0xb101e8
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2
PreBindAssemblyEx+0x6798 StrongNameSignatureVerification-0xb7b3 clr+0x17e303 @ 0x740de303
sxsJitStartup-0x14c66 clrjit+0x3fc2e @ 0x73e4fc2e
sxsJitStartup-0x36b91 clrjit+0x1dd03 @ 0x73e2dd03
sxsJitStartup-0x52e34 clrjit+0x1a60 @ 0x73e11a60
sxsJitStartup-0x52c52 clrjit+0x1c42 @ 0x73e11c42
sxsJitStartup-0x52447 clrjit+0x244d @ 0x73e1244d
sxsJitStartup-0x50878 clrjit+0x401c @ 0x73e1401c
sxsJitStartup-0x50762 clrjit+0x4132 @ 0x73e14132
sxsJitStartup-0x50612 clrjit+0x4282 @ 0x73e14282
sxsJitStartup-0x502ff clrjit+0x4595 @ 0x73e14595
CreateAssemblyNameObject+0x61d0 GetMetaDataInternalInterface-0x3229f clr+0x33669 @ 0x73f93669
CreateAssemblyNameObject+0x6268 GetMetaDataInternalInterface-0x32207 clr+0x33701 @ 0x73f93701
CreateAssemblyNameObject+0x62aa GetMetaDataInternalInterface-0x321c5 clr+0x33743 @ 0x73f93743
CreateAssemblyNameObject+0x6503 GetMetaDataInternalInterface-0x31f6c clr+0x3399c @ 0x73f9399c
CreateAssemblyNameObject+0x5ffd GetMetaDataInternalInterface-0x32472 clr+0x33496 @ 0x73f93496
CreateAssemblyNameObject+0x6c42 GetMetaDataInternalInterface-0x3182d clr+0x340db @ 0x73f940db
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f7bcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f62ae9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x740274ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74027610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x740b1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x740b1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x740b1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x740b416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7460f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74897f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74894de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 d8 c7 45 e4 00 00 00
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xb1094b
registers.esp: 3069832
registers.edi: 36621608
registers.eax: 0
registers.ebp: 3069876
registers.edx: 195
registers.ebx: 36622068
registers.esi: 36697764
registers.ecx: 0
1 0 0
domain fdute32sdajfsda.hopto.org
domain dtte48ksk8ds5.hopto.org
domain udtte45k8ds5.hopto.org
domain 67b8nd9smfu0n8b7ds.hopto.org
domain 8n7tgfdsn87dsfu9n.hopto.org
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00520000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00560000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1076
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1076
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00610000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02050000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02210000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00536000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00537000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff60000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff68000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2580
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\CrashDumps\Crash.exe
file C:\Windows\Performance\WinSAT\issas.exe
cmdline "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes & exit
cmdline schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST
cmdline cmd /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
cmdline cmd /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
cmdline schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST
file C:\Windows\Performance\WinSAT\issas.exe
file C:\Users\test22\AppData\Local\CrashDumps\Crash.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes & exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes
cmdline cmd /c netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes & exit
cmdline "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes & exit
cmdline schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST
cmdline cmd /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
cmdline cmd /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
cmdline schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST
cmdline schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST
cmdline cmd /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
cmdline cmd /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Web Edge" /tr "C:\Users\test22\AppData\Local\CrashDumps\Crash.exe" /RL HIGHEST & exit
cmdline schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\issas" /tr "C:\Windows\Performance\WinSAT\issas.exe" /RL HIGHEST
cmdline netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes
cmdline cmd /c netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes & exit
cmdline "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="issas" dir=in action=allow program="C:\Windows\Performance\WinSAT\issas.exe" enable=yes & exit
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Generic.4!c
CAT-QuickHeal Trojan.Generic
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Zusy.565386
Cylance Unsafe
VIPRE Gen:Variant.Zusy.565386
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Zusy.565386
K7GW Trojan ( 005bca741 )
K7AntiVirus Trojan ( 005bca741 )
Arcabit Trojan.Zusy.D8A08A
VirIT Trojan.Win32.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Agent.EYT
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
ClamAV Win.Packed.Msilzilla-10036934-0
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Trojan:MSIL/Leonem.e429d990
NANO-Antivirus Trojan.Win32.AVI.ktfqzp
MicroWorld-eScan Gen:Variant.Zusy.565386
Rising Trojan.Agent!8.B1E (CLOUD)
Emsisoft Gen:Variant.Zusy.565386 (B)
F-Secure Trojan.TR/AVI.Agent.yhjgt
DrWeb Trojan.Siggen29.63218
McAfeeD Real Protect-LS!7B429FA791C9
CTX exe.trojan.msil
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.7b429fa791c946c6
Google Detected
Avira TR/AVI.Agent.yhjgt
Antiy-AVL GrayWare/Win32.Agent
Kingsoft Win32.Trojan.Generic.a
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Malware@#2x5d4px7pwkhk
Microsoft Trojan:Win32/Leonem
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Zusy.565386
Varist W32/ABTrojan.FCHM-2216
AhnLab-V3 Trojan/Win.Generic.C5690046
McAfee Artemis!7B429FA791C9
DeepInstinct MALICIOUS
VBA32 TScope.Trojan.MSIL
Malwarebytes Malware.AI.3919996942
Ikarus Trojan.MSIL.Agent
Panda Trj/Chgt.AD
Tencent Malware.Win32.Gencirc.11cb13bf
Yandex Trojan.Agent!8viwVk6IZ5k