Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 18, 2025, 9:58 a.m.	Jan. 18, 2025, 10:01 a.m.

Size	3.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6626a89aa5cc47a20e9de81360327a3e`
SHA256	`f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7`
CRC32	`DCE2A6F4`
ssdeep	`49152:fT2Wd4IbtCaIZ+SgnCxaC+1R5oWjhRSTp8Z2WTWw/10tte7:SW5QxajvOWM8UWTWw/IU`
PDB Path	C:\Users\admin\source\repos\droidcamapp\Release\DroidCamApp.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature ftp_command - ftp command Antivirus - Contains references to security software IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

4909_7122.exe "C:\Users\test22\AppData\Local\Temp\4909_7122.exe"
2544

Name	Response	Post-Analysis Lookup
republicadominica2025.ip-ddns.com		177.255.85.101

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

C:\Users\admin\source\repos\droidcamapp\Release\DroidCamApp.pdb

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	AFX_DIALOG_LAYOUT
resource name	BRANDING
resource name	INI

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 167936 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 360448 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 742963ea08a4ce2d1aa561c87ff65ad326e89f2a

Allocates execute permission to another process indicative of possible code injection (50 out of 129 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f1000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f2000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f3000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f4000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f5000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f6000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f7000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f8000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f9000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fa000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fb000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fc000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fd000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fe000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001ff000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00201000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00202000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00203000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00204000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00205000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00206000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00207000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00208000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00209000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020a000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020b000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020c000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020d000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020e000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020f000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00211000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00212000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00213000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00214000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00215000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00216000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00217000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00218000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00219000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021a000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021b000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021c000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021d000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021e000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021f000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00220000 process_handle: 0x000000d4	1
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00221000 process_handle: 0x000000d4	1

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\NordicVPN

reg_value

C:\Users\test22\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

Manipulates memory of a non-child process indicative of process injection (50 out of 131 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 manipulating memory of non-child process 2716
NtAllocateVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 2 (PAGE_READONLY) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f0000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f1000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f2000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f3000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f4000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f5000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f6000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f7000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f8000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001f9000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fa000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fb000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fc000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fd000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001fe000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001ff000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00201000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00202000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00203000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00204000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00205000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00206000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00207000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00208000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00209000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020a000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020b000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020c000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020d000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020e000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0020f000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00211000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00212000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00213000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00214000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00215000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00216000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00217000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00218000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00219000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021a000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021b000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021c000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021d000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021e000 process_handle: 0x000000d4	1	0	0
NtProtectVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0021f000 process_handle: 0x000000d4	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 injected into non-child 2716
WriteProcessMemory Jan. 18, 2025, 9:59 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2716 process_handle: 0x000000d4	1	1	0

Executed a process and injected code into it, probably while unpacking (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Jan. 18, 2025, 9:59 a.m.	thread_identifier: 2720 thread_handle: 0x000000d0 process_identifier: 2716 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\4909_7122.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\4909_7122.exe stack_pivoted: 0 creation_flags: 2 (DEBUG_ONLY_THIS_PROCESS) inherit_handles: 0 process_handle: 0x000000d4	1	1
NtGetContextThread Jan. 18, 2025, 9:59 a.m.	thread_handle: 0x000000d0	1	0
NtAllocateVirtualMemory Jan. 18, 2025, 9:59 a.m.	process_identifier: 2716 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 2 (PAGE_READONLY) base_address: 0x001f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000d4	1	0
WriteProcessMemory Jan. 18, 2025, 9:59 a.m.	buffer: base_address: 0x001f0000 process_identifier: 2716 process_handle: 0x000000d4	1	1
WriteProcessMemory Jan. 18, 2025, 9:59 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2716 process_handle: 0x000000d4	1	1

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Lionic	Trojan.Win32.Remcos.4!c
CAT-QuickHeal	cld.backdoor.msil
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Lazy.638917
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.638917
Sangfor	Trojan.Win32.Remcos.V80c
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Lazy.638917
K7GW	Riskware ( 00584baa1 )
K7AntiVirus	Riskware ( 00584baa1 )
Arcabit	Trojan.Lazy.D9BFC5
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Rescoms.B
Avast	Win32:Evo-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
NANO-Antivirus	Virus.Win32.Gen.ccmw
MicroWorld-eScan	Gen:Variant.Lazy.638917
Rising	Backdoor.Crysan!8.10ECA (LESS:bWQ1OlhNjEVg+Tku)
Emsisoft	Gen:Variant.Lazy.638917 (B)
F-Secure	Trojan.TR/AVI.Remcos.dknxt
McAfeeD	ti!F9C6E2F4C1BE
CTX	exe.unknown.lazy
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Lazy.638917
Google	Detected
Avira	TR/AVI.Remcos.dknxt
Antiy-AVL	Trojan[Backdoor]/MSIL.Crysan
Kingsoft	MSIL.Backdoor.Crysan.gen
Microsoft	Trojan:Win32/Remcos!rfn
GData	Win32.Backdoor.Remcos.N2TYIF
McAfee	Artemis!6626A89AA5CC
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.1309309937
Ikarus	Trojan.Win32.Crypt
TrendMicro-HouseCall	TROJ_GEN.R002H09AG25
huorong	HEUR:Trojan/Loader.j
Fortinet	W32/PossibleThreat
AVG	Win32:Evo-gen [Trj]
Paloalto	generic.ml

4909_7122.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All