Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 16, 2025, 9:13 a.m.	March 16, 2025, 9:17 a.m.

Size	579.0KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`6bbb3762b42f726dfc7c98e82828503e`
SHA256	`8485d594346a4e1f7130ff9df286d01aaed2fd1b3954dbfd99d2c32f2641dc4f`
CRC32	`6E5AF19A`
ssdeep	`12288:UdZ0kOMs+sFHLoE1X3MoAisNCtg+k2DAEJXRQSL4uxSKp6EvuBl+:YSxh+U7dMoBMeg+k2DAP6qKR2l`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2548
- GqXNNy99CBoGv7HuUrDueosV.exe "C:\Users\test22\AppData\Local\Temp\iofolko5\GqXNNy99CBoGv7HuUrDueosV.exe"
  2636
- KBQJPdhnmHjc4pXhXc3H9l6s.exe "C:\Users\test22\AppData\Local\Temp\iofolko5\KBQJPdhnmHjc4pXhXc3H9l6s.exe"
  2676
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 16, 2025, 9:13 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 16, 2025, 9:13 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 16, 2025, 9:13 a.m.			0	0
IsDebuggerPresent March 16, 2025, 9:13 a.m.			0	0
IsDebuggerPresent March 16, 2025, 9:13 a.m.			0	0
IsDebuggerPresent March 16, 2025, 9:13 a.m.			0	0
IsDebuggerPresent March 16, 2025, 9:13 a.m.			0	0

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	c:\program files\mozilla firefox\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 16, 2025, 9:13 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.dosx
section	.fish

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b11000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef41ab000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b12000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b14000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9436a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9441c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9437c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9436b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9438b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9438d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94362000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9437a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:13 a.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe944d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 16, 2025, 9:14 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW March 16, 2025, 9:13 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13323096064 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW March 16, 2025, 9:13 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13323096064 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW March 16, 2025, 9:13 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13323096064 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\iofolko5\GqXNNy99CBoGv7HuUrDueosV.exe
file	C:\Users\test22\AppData\Local\Temp\iofolko5\KBQJPdhnmHjc4pXhXc3H9l6s.exe

Creates a shortcut to an executable file (13 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: taskhost.exe process_identifier: 2372	1	1
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: schtasks.exe process_identifier: 2600	1	1
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0008d800', u'virtual_address': u'0x0002b000', u'entropy': 7.78514150565358, u'name': u'.fish', u'virtual_size': u'0x0008e000'}

entropy

7.78514150565

description

A section with a high entropy has been found

entropy

0.978392394123

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (9 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW March 16, 2025, 9:13 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (32 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: random.exe process_identifier: 2548		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x00000000000000a4 process_name: conhost.exe process_identifier: 2608		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0
Process32NextW March 16, 2025, 9:13 a.m.	snapshot_handle: 0x0000000000000088 process_name: KBQJPdhnmHjc4pXhXc3H9l6s.exe process_identifier: 2676		0	0

Checks the presence of IDE drives in the registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9f81a905-2336-4bc5-84f3-fc197f6a4689

reg_value

C:\Users\test22\AppData\Local\Temp\iofolko5\KBQJPdhnmHjc4pXhXc3H9l6s.exe

Creates an executable file in a user folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\iofolko5\KBQJPdhnmHjc4pXhXc3H9l6s.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\iofolko5\GqXNNy99CBoGv7HuUrDueosV.exe
file	C:\Users\test22\AppData\Local\Temp\iofolko5\KBQJPdhnmHjc4pXhXc3H9l6s.exe

Detects VirtualBox through the presence of a device (2 events)

file	\??\VBoxMiniRdrDN
file	\\?\pipe\VBoxTrayIPC

Detects VirtualBox through the presence of a file (1 event)

dll	VBoxHook.dll

Detects VirtualBox through the presence of a registry key (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
registry	HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects VMWare through the presence of various files (2 events)

file	C:\Windows\System32\drivers\vmmouse.sys
file	C:\Windows\System32\drivers\vmhgfs.sys

Detects VMWare through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.Common.3C96E667
Lionic	Trojan.Win32.Khalesi.4!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Ghanarava.174163890528503e
Skyhigh	BehavesLike.Win64.Dropper.hc
Cylance	Unsafe
VIPRE	Gen:Heur.Mint.Zard.42
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Heur.Mint.Zard.42
K7GW	Riskware ( 00584baa1 )
K7AntiVirus	Riskware ( 00584baa1 )
Arcabit	Trojan.Mint.Zard.42
VirIT	Trojan.Win64.Agent.HWG
Symantec	Backdoor.Cobalt
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/CoinMiner_AGen.V potentially unwanted
APEX	Malicious
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	Trojan.Win32.Khalesi.qnpu
NANO-Antivirus	Trojan.Win64.Khalesi.kwacqi
MicroWorld-eScan	Gen:Heur.Mint.Zard.42
Rising	Trojan.Kryptik@AI.86 (RDML:7lCorl7H3DbvKpUxW0nQiQ)
Emsisoft	Gen:Heur.Mint.Zard.42 (B)
F-Secure	Trojan.TR/AVI.Agent.ucbcs
DrWeb	Trojan.Encoder.41746
McAfeeD	ti!8485D594346A
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.khalesi
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.6bbb3762b42f726d
Google	Detected
Avira	TR/AVI.Agent.ucbcs
Kingsoft	malware.kb.b.970
Gridinsoft	Trojan.Heur!.032120E3
Xcitium	ApplicUnwnt@#2zxvi8rxepqxv
Microsoft	Trojan:Win32/Phonzy.B!ml
GData	Gen:Heur.Mint.Zard.42
Varist	W64/ABTrojan.MHGY-1777
AhnLab-V3	Trojan/Win.Generic.C5739031
McAfee	Artemis!6BBB3762B42F
DeepInstinct	MALICIOUS
VBA32	Trojan.Khalesi
Malwarebytes	PUP.Optional.ZenMateVPN
Ikarus	Trojan-Dropper.Win64.Agent
TrendMicro-HouseCall	TROJ_GEN.R002H09C925
Tencent	Win32.Trojan.Khalesi.Iajl
MaxSecure	Trojan.Malware.237179159.susgen
Fortinet	W32/PossibleThreat
AVG	Win64:MalwareX-gen [Trj]

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All