Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 23, 2025, 6:24 p.m.	Jan. 23, 2025, 6:31 p.m.

Size	323.9KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a47e4a0f261c300fb4b350ba21702cdf`
SHA256	`5b4632479dcd834af5e8fe3dc16a91df6d2fe405899d5b34ef8261d5a2e78d26`
CRC32	`B40C2FC3`
ssdeep	`6144:Mn7NGEsmze3cpLEnuom90tqGBwVJOjaiC+N4D4PPx5+u5/yBl:FBJcpLEn0jHHOja7+2krPY`
PDB Path	c:\rje\tg\gji28\obj\Release\uÿ.pdb
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) IsPE32 - (no description)

update.exe "C:\Users\test22\AppData\Local\Temp\update.exe"
1696
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2168

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.215.113.22	Active	Moloch
80.76.51.171	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 23, 2025, 6:24 p.m.			0	0
IsDebuggerPresent Jan. 23, 2025, 6:24 p.m.			0	0
IsDebuggerPresent Jan. 23, 2025, 6:24 p.m.			0	0
IsDebuggerPresent Jan. 23, 2025, 6:24 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b2540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b2540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b2540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b2540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b25c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b25c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b24c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b24c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b24c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b24c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b24c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3440 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3440 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007b3400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

c:\rje\tg\gji28\obj\Release\uÿ.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 23, 2025, 6:24 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 74 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02120000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00355000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0035b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00357000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00346000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00347000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 1696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02471000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74562000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74492000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cfb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e52000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7357a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00617000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e3f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e09e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726ab000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1

Creates hidden or system file (4 events)

Time & API	Arguments	Return
NtCreateFile Jan. 23, 2025, 6:24 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Jan. 23, 2025, 6:24 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Jan. 23, 2025, 6:24 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Jan. 23, 2025, 6:24 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004dc00', u'virtual_address': u'0x00002000', u'entropy': 7.995386221345923, u'name': u'.text', u'virtual_size': u'0x0004daf4'}

entropy

7.99538622135

description

A section with a high entropy has been found

entropy

0.993610223642

description

Overall entropy of this PE file is high

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (2 events)

host	185.215.113.22
host	80.76.51.171

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Jan. 23, 2025, 6:24 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÂÆè à0ìÐº @ @4ºO ÌÉº H.textlê ì `.rsrcÌÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2168 process_handle: 0x00000244	1	1
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: °: base_address: 0x00450000 process_identifier: 2168 process_handle: 0x00000244	1	1
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2168 process_handle: 0x00000244	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÂÆè à0ìÐº @ @4ºO ÌÉº H.textlê ì `.rsrcÌÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2168 process_handle: 0x00000244	1	1	0

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1696 called NtSetContextThread to modify thread in remote process 2168
NtSetContextThread Jan. 23, 2025, 6:24 p.m.	registers.eip: 2005598660 registers.esp: 1376000 registers.edi: 0 registers.eax: 4373126 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000240 process_identifier: 2168	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1696 resumed a thread in remote process 2168
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2168	1	0	0

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.215.113.22:80

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1696	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 1696	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1696	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 1696	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 1696	1	0
CreateProcessInternalW Jan. 23, 2025, 6:24 p.m.	thread_identifier: 2172 thread_handle: 0x00000240 process_identifier: 2168 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000244	1	1
NtGetContextThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000240	1	0
NtAllocateVirtualMemory Jan. 23, 2025, 6:24 p.m.	process_identifier: 2168 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000244	1	0
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÂÆè à0ìÐº @ @4ºO ÌÉº H.textlê ì `.rsrcÌÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2168 process_handle: 0x00000244	1	1
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: base_address: 0x00402000 process_identifier: 2168 process_handle: 0x00000244	1	1
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: base_address: 0x00432000 process_identifier: 2168 process_handle: 0x00000244	1	1
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: °: base_address: 0x00450000 process_identifier: 2168 process_handle: 0x00000244	1	1
WriteProcessMemory Jan. 23, 2025, 6:24 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2168 process_handle: 0x00000244	1	1
NtSetContextThread Jan. 23, 2025, 6:24 p.m.	registers.eip: 2005598660 registers.esp: 1376000 registers.edi: 0 registers.eax: 4373126 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000240 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000240 suspend_count: 1 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000370 suspend_count: 1 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:24 p.m.	thread_handle: 0x00000384 suspend_count: 1 process_identifier: 2168	1	0
NtResumeThread Jan. 23, 2025, 6:25 p.m.	thread_handle: 0x00000384 suspend_count: 1 process_identifier: 2168	1	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
Skyhigh	BehavesLike.Win32.AdwareFiseria.fc
ALYac	Gen:Variant.Jalapeno.18436
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.18436
Sangfor	Trojan.Win32.Kryptik.Vz49
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Gen:Variant.Jalapeno.18436
K7GW	Trojan ( 005baba81 )
K7AntiVirus	Trojan ( 005baba81 )
Arcabit	Trojan.Jalapeno.D4804
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.HBWQ
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Pwsx-10035189-0
Alibaba	Trojan:MSIL/Stelpak.bd1c0ffc
MicroWorld-eScan	Gen:Variant.Jalapeno.18436
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:32WbRvDYa5oNiKIZNFXC1Q)
Emsisoft	Gen:Variant.Jalapeno.18436 (B)
F-Secure	Trojan.TR/AD.Nekark.umzeh
Zillya	Trojan.GenKryptik.Win32.978330
TrendMicro	TrojanSpy.Win32.REDLINE.YXEIUZ
McAfeeD	ti!5B4632479DCD
CTX	exe.trojan.msil
Sophos	Mal/MSIL-WA
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.a47e4a0f261c300f
Google	Detected
Avira	TR/AD.Nekark.umzeh
Kingsoft	MSIL.Trojan.Stelpak.gen
Gridinsoft	Trojan.Win32.Packed.dd!ni
Microsoft	Trojan:MSIL/LummaStealer.GPD!MTB
GData	Gen:Variant.Jalapeno.18436
Varist	W32/MSIL_Agent.ILW.gen!Eldorado
AhnLab-V3	Trojan/Win.Vidar.C5672639
McAfee	GenericRXWP-EE!A47E4A0F261C
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL
Ikarus	Trojan.MSIL.Krypt
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEIUZ
Tencent	Trojan.Msil.Stelpak.16001404
Yandex	Trojan.Stelpak!axIcEs4nIlI
huorong	Trojan/MSIL.Agent.li
MaxSecure	Trojan.Malware.274051615.susgen
Fortinet	MSIL/GenKryptik.HBSY!tr

update.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All