Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 10, 2025, 4:13 p.m.	Feb. 10, 2025, 4:28 p.m.

Size	1.6MB
Type	Microsoft Cabinet archive data, 4294967295 bytes, 1 file
MD5	`fcd3c21e69ff97facbbe82ca7955d171`
SHA256	`6ba3ba80b19897c2f537e77b51bd3c44ae39cde5c948c9c9be537c394805befa`
CRC32	`0CADAF9C`
ssdeep	`24576:JRWFfJWgG0FGHgIMpR76tfveSE3eqRfZJll2+L4uv1IhVuw89Tlp8O:J+sgl09Wcv0f5zt8uyhYXlOO`
Yara	Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "ntkaP" C:\Users\test22\AppData\Local\Temp\bas.bat
2556
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\bas.bat
  2628
  - extrac32.exe extrac32 /y "C:\Users\test22\AppData\Local\Temp\bas.bat" "C:\Users\test22\AppData\Local\Temp\x.exe"
    2716
  - x.exe "C:\Users\test22\AppData\Local\Temp\x.exe"
    2772

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
94.130.53.50	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 9, 2025, 1:03 p.m.			0	0

Command line console output was observed (13 events)

Time & API	Arguments	Status	Return
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: MSCF console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: 'MSCF' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: cls console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: extrac32 console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: /y "C:\Users\test22\AppData\Local\Temp\bas.bat" "C:\Users\test22\AppData\Local\Temp\x.exe" console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: start console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: "" "C:\Users\test22\AppData\Local\Temp\x.exe" console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: óâ$7 console_handle: 0x00000007	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: 'óâ$7' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 9, 2025, 1:03 p.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 9, 2025, 1:03 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Feb. 9, 2025, 1:03 p.m.	stacktrace: x+0x7061c @ 0x47061c x+0x73841 @ 0x473841 x+0x4577 @ 0x404577 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 33 6a 00 6a 00 6a 00 6a 00 ff 35 64 96 47 00 exception.symbol: x+0x6dda8 exception.instruction: push dword ptr [ebx] exception.module: x.exe exception.exception_code: 0xc0000005 exception.offset: 449960 exception.address: 0x46dda8 registers.esp: 1636980 registers.edi: 31897648 registers.eax: 1024 registers.ebp: 1637760 registers.edx: 792 registers.ebx: 2135257680 registers.esi: 1 registers.ecx: 149512	1	0	0
__exception__ Feb. 9, 2025, 1:03 p.m.	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x76f56a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x736f482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x76f20143 x+0x7061c @ 0x47061c x+0x73841 @ 0x473841 x+0x4577 @ 0x404577 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 4a f8 49 7c 0e f0 ff 4a f8 75 08 8d 42 f8 e8 exception.symbol: x+0x480e exception.instruction: mov ecx, dword ptr [edx + 0xfffffff8] exception.module: x.exe exception.exception_code: 0xc0000005 exception.offset: 18446 exception.address: 0x40480e registers.esp: 1635204 registers.edi: 0 registers.eax: 1634880 registers.ebp: 1635240 registers.edx: 1 registers.ebx: 1634932 registers.esi: 70 registers.ecx: 1637760	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 55 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Feb. 9, 2025, 1:03 p.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00479680 process_handle: 0xffffffff		3221225496

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

Yara rule detected in process memory (50 out of 62 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl

Communicates with host for which no DNS query was performed (1 event)

host

94.130.53.50

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\x.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2628 resumed a thread in remote process 2772
NtResumeThread Feb. 9, 2025, 1:03 p.m.	thread_handle: 0x0000008c suspend_count: 0 process_identifier: 2772	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.ZIP.ModiLoader.4!c
CTX	cab.trojan.modiloader
VIPRE	Gen:Variant.Strictor.295608
Arcabit	Trojan.Strictor.D482B8
Symantec	Trojan.Malcab
ESET-NOD32	a variant of Win32/TrojanDownloader.ModiLoader.AHE
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Delf.gen
BitDefender	Gen:Variant.Strictor.295608
Rising	Trojan.ModiLoader!1.127F9 (CLASSIC)
Emsisoft	Gen:Variant.Strictor.295608 (B)
DrWeb	Trojan.Packed2.46247
Sophos	Generic ML PUA (PUA)
Ikarus	PUA.EnigmaProtector
FireEye	Gen:Variant.Strictor.295608
Google	Detected
Antiy-AVL	Trojan/Win32.Delf
Kingsoft	Win32.Trojan.Delf.gen
GData	Gen:Variant.Strictor.295608
Varist	W32/Trojan.OWUO-4731
Tencent	Malware.Win32.Gencirc.10c0c8e0
Fortinet	W32/Dropper.CAB!tr
AVG	Other:Malware-gen [Trj]
Panda	Trj/GdSda.A
alibabacloud	Trojan[downloader]:Win/ModiLoader.AJM

bas.bat

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All