Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 12, 2025, 11:25 a.m.	March 12, 2025, 11:34 a.m.

Size	487.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`db59bfef32bc15d53bdf499dd1ae62c4`
SHA256	`c0297a465ab62db781cd06295004e14eac2d87905b5015b1cc02b446a34bf042`
CRC32	`69530776`
ssdeep	`6144:HIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6GJ:H200OFp+G0imvHn3Cp6qyBP+YdsvZGo`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature infoStealer_browser_b_Zero - browser info stealer Malicious_Packer_Zero - Malicious Packer Network_Downloader - File Downloader IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

crossings.exe "C:\Users\test22\AppData\Local\Temp\crossings.exe"
508
- firefox tsm.exe "C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
  2068
  - RmClient.exe rmclient.exe
    2504

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.135.156.200	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 12, 2025, 11:25 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

A process attempted to delay the analysis task. (1 event)

description

firefox tsm.exe tried to sleep 473 seconds, actually delayed analysis time by 473 seconds

Yara rule detected in process memory (23 events)

description	Create a windows service	rule	Create_Service
description	Client_SW_User_Data_Stealer	rule	Client_SW_User_Data_Stealer
description	Win Backdoor RemcosRAT	rule	Win_Backdoor_RemcosRAT
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Run a KeyLogger	rule	KeyLogger

Terminates another process (20 events)

Time & API	Arguments	Status
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2116 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2116 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2152 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2152 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2188 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2188 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2224 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2224 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2260 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2260 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2296 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2296 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2332 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2332 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2368 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2368 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2404 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2404 process_handle: 0x000000c8	1
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2440 process_handle: 0x000000c8
NtTerminateProcess March 12, 2025, 11:25 a.m.	status_code: 0x00000000 process_identifier: 2440 process_handle: 0x000000c8	1

Communicates with host for which no DNS query was performed (1 event)

host

91.135.156.200

Installs itself for autorun at Windows startup (50 out of 123 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-QPMRI0	reg_value	"C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe"

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 12, 2025, 11:25 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2504 process_handle: 0x00000144	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA March 12, 2025, 11:25 a.m.	thread_identifier: 0 callback_function: 0x00409d0a hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	131535	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2068 called NtSetContextThread to modify thread in remote process 2504
NtSetContextThread March 12, 2025, 11:25 a.m.	registers.eip: 2005598660 registers.esp: 3078924 registers.edi: 0 registers.eax: 937316 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000140 process_identifier: 2504	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2068 resumed a thread in remote process 2504
NtResumeThread March 12, 2025, 11:25 a.m.	thread_handle: 0x00000140 suspend_count: 1 process_identifier: 2504	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

91.135.156.200:8109

Executed a process and injected code into it, probably while unpacking (27 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2072 thread_handle: 0x000003f8 process_identifier: 2068 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe" filepath_r: C:\Users\test22\AppData\Roaming\firefox tsm\firefox tsm.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000404	1	1
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2120 thread_handle: 0x000000c0 process_identifier: 2116 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2156 thread_handle: 0x000000c0 process_identifier: 2152 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2192 thread_handle: 0x000000c0 process_identifier: 2188 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2228 thread_handle: 0x000000c0 process_identifier: 2224 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2264 thread_handle: 0x000000c0 process_identifier: 2260 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2300 thread_handle: 0x000000c0 process_identifier: 2296 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2336 thread_handle: 0x000000c0 process_identifier: 2332 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2372 thread_handle: 0x000000c0 process_identifier: 2368 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2408 thread_handle: 0x000000c0 process_identifier: 2404 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2444 thread_handle: 0x000000c0 process_identifier: 2440 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x000000c0		3221225485
CreateProcessInternalW March 12, 2025, 11:25 a.m.	thread_identifier: 2508 thread_handle: 0x00000140 process_identifier: 2504 current_directory: filepath: track: 1 command_line: rmclient.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000144	1	1
NtGetContextThread March 12, 2025, 11:25 a.m.	thread_handle: 0x00000140	1	0
NtMapViewOfSection March 12, 2025, 11:25 a.m.	section_handle: 0x0000014c process_identifier: 2504 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x000b0000 allocation_type: 0 () section_offset: 0 view_size: 528384 process_handle: 0x00000144	1	0
WriteProcessMemory March 12, 2025, 11:25 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2504 process_handle: 0x00000144	1	1
NtSetContextThread March 12, 2025, 11:25 a.m.	registers.eip: 2005598660 registers.esp: 3078924 registers.edi: 0 registers.eax: 937316 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000140 process_identifier: 2504	1	0
NtResumeThread March 12, 2025, 11:25 a.m.	thread_handle: 0x00000140 suspend_count: 1 process_identifier: 2504	1	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Remcos.m!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Ghanarava.1741713795ae62c4
Skyhigh	BehavesLike.Win32.Remcos.gh
ALYac	Generic.Dacic.A9349469.A.FE6251BC
Cylance	Unsafe
VIPRE	Generic.Dacic.A9349469.A.FE6251BC
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Generic.Dacic.A9349469.A.FE6251BC
K7GW	Trojan ( 0053ac2c1 )
K7AntiVirus	Trojan ( 0053ac2c1 )
Arcabit	Generic.Dacic.A9349469.A.FE6251BC
VirIT	Trojan.Win32.Remcos.DFP
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Remcos
ESET-NOD32	a variant of Win32/Rescoms.B
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
ClamAV	Win.Trojan.Remcos-9841897-0
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
Alibaba	Backdoor:Win32/Remcos.0c401fd8
NANO-Antivirus	Trojan.Win32.Remcos.kvsovm
MicroWorld-eScan	Generic.Dacic.A9349469.A.FE6251BC
Rising	Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft	Generic.Dacic.A9349469.A.FE6251BC (B)
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	BackDoor.Remcos.491
Zillya	Trojan.Rescoms.Win32.2189
McAfeeD	Real Protect-LS!DB59BFEF32BC
CTX	exe.trojan.remcos
Sophos	Mal/Remcos-B
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.db59bfef32bc15d5
Webroot	Win.Backdoor.Remcos
Google	Detected
Avira	BDS/Backdoor.Gen
Antiy-AVL	GrayWare/Win32.Wacapew
Kingsoft	malware.kb.a.1000
Gridinsoft	Trojan.Win32.Remcos.tr
Microsoft	Backdoor:Win32/Remcos.GA!MTB
ZoneAlarm	Mal/Remcos-B
GData	Win32.Backdoor.Remcos.EEXSL2
Varist	W32/Agent.JUB.gen!Eldorado
AhnLab-V3	Backdoor/Win.Remcos.R693720
McAfee	Artemis!DB59BFEF32BC
DeepInstinct	MALICIOUS
VBA32	Win32.Trojan.Dropper.Heur
Malwarebytes	Backdoor.Remcos

crossings.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All