popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

493745173.exe

UltraVNC
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 12, 2021, 11:52 a.m. March 12, 2021, 11:55 a.m.
Size 256.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b582051ea2ba53c5c4c57e0580e88bd1
SHA256 95217e25848c423bb5ef5f24ddaa516909f0398d412ab6762e9c7de1dd051a4e
CRC32 828521EF
ssdeep 3072:YDKW1LgppLRHMY0TBfJvjcTp5Xx00uyvq9heJrU1NjLcI0PBsfC:YDKW1Lgbdl0TBBvjc/UyWJ1+IABu
PDB Path
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • UltraVNC_Zero - UltraVNC
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
45.14.13.58 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00556570
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00556570
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005565b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005565b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005567b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005567f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005567f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005568b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005568b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00556a70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: 493745173+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4350244
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 12
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4353968
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 503
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4358064
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 471
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4362160
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 439
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4366256
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 407
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4370352
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 375
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4374448
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 343
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4378544
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 311
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4382640
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 279
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4386736
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 247
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4390832
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 215
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4394928
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 183
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4399024
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 151
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4403120
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 119
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4407216
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 87
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4411312
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 55
1 0 0

__exception__

 stacktrace: 
493745173+0xf054 @ 0x40f054
493745173+0xf0a0 @ 0x40f0a0
493745173+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 493745173+0xefff
exception.address: 0x40efff
exception.module: 493745173.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4415408
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 90
registers.ebx: 0
registers.esi: 31981640
registers.ecx: 23
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02200000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02080000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02200000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00492000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02171000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02172000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02173000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02174000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a2f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02331000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004cd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ce000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff30000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00011200', u'virtual_address': u'0x00026000', u'entropy': 7.985407906826652, u'name': u'.rsrc', u'virtual_size': u'0x00011100'} entropy 7.98540790683 description A section with a high entropy has been found
entropy 0.336609336609 description Overall entropy of this PE file is high
url http://tempuri.org/IConnectionRegister/ValidateUriRouteResponse
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/IssueT
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/IssueT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateT
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/RenewT
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/IssueT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/CancelT
url http://schemas.xmlsoap.org/ws/2004/09/mext
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/CancelT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal
url http://tempuri.org/
url http://tempuri.org/IRemotePanel/GetSettings
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/ValidateT
url http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponseT
url http://schemas.xmlsoap.org/ws/2004/09/transfer/GetT
url http://tempuri.org/IConnectionRegister/ValidateUriRouteT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinalw
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/RenewT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/IssueT
url http://schemas.xmlsoap.org/soap/envelope/
url http://schemas.xmlsoap.org/ws/2004/09/mexX
url http://schemas.xmlsoap.org/wsdl/3
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Validate
url http://schemas.xmlsoap.org/ws/2004/09/mexZ
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/CancelT
url http://schemas.xmlsoap.org/ws/2004/09/mexQ
url http://schemas.datacontract.org/2004/07/System
url http://schemas.xmlsoap.org/ws/2004/08/addressing
url http://schemas.xmlsoap.org/ws/2004/09/mex
url http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponse
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewT
url http://go2.microsoft.com/fwlink/?LinkId=131738
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Cancel
url http://schemas.xmlsoap.org/ws/2004/09/mexJ
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Renew
url http://schemas.xmlsoap.org/ws/2005/02/trust/RST/ValidateT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RenewT
url http://schemas.xmlsoap.org/ws/2004/09/mexo
url http://beta.visualstudio.net/net/sdk/feedback.asp
url http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/ValidateT
url http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over Toredo network rule network_toredo
description Communications smtp rule network_smtp_dotNet
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Possibly employs anti-virtualization techniques rule vmdetect
description Detection of Virtual Appliances through the use of WMI for use of evasion. rule WMI_VM_Detect
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
host 45.14.13.58
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.363132
FireEye Generic.mg.b582051ea2ba53c5
CAT-QuickHeal Trojan.Multi
ALYac Gen:Variant.Bulz.363132
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanPSW:MSIL/Agensla.c1f0269f
K7GW Spyware ( 00576cc11 )
K7AntiVirus Spyware ( 00576cc11 )
Arcabit Trojan.Bulz.D58A7C
BitDefenderTheta Gen:NN.ZexaF.34608.qq3@ayh5WWe
Cyren W32/Trojan.DAN.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky Trojan-PSW.MSIL.Agensla.udh
BitDefender Gen:Variant.Bulz.363132
Paloalto generic.ml
Rising Spyware.Agent!8.C6 (CLOUD)
Ad-Aware Gen:Variant.Bulz.363132
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.PWS.Siggen2.62472
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DC621
McAfee-GW-Edition BehavesLike.Win32.Ransom.dh
Emsisoft Gen:Variant.Bulz.363132 (B)
SentinelOne Static AI - Malicious PE
ESET-NOD32 a variant of MSIL/Spy.Agent.DCX
eGambit Unsafe.AI_Score_98%
Avira TR/Dropper.Gen
MAX malware (ai score=100)
Antiy-AVL Trojan[PSW]/MSIL.Agensla
Gridinsoft Trojan.Win32.Agent.ns
Microsoft Trojan:MSIL/MassLoagger.AD!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm Trojan-PSW.MSIL.Agensla.udh
GData Gen:Variant.Bulz.363132
Cynet Malicious (score: 100)
Acronis suspicious
McAfee RDN/Generic PWS.y
VBA32 Trojan.ClipBanker
Malwarebytes Trojan.Banker
TrendMicro-HouseCall TROJ_GEN.R002C0DC621
Tencent Msil.Trojan-qqpass.Qqrob.Pfiw
Ikarus Trojan.MSIL.CoinMiner
MaxSecure Trojan.Malware.300983.susgen
dead_host 192.168.56.101:49202
dead_host 192.168.56.101:49231
dead_host 192.168.56.101:49233
dead_host 192.168.56.101:49211
dead_host 192.168.56.101:49212
dead_host 192.168.56.101:49206
dead_host 192.168.56.101:49219
dead_host 192.168.56.101:49237
dead_host 192.168.56.101:49215
dead_host 192.168.56.101:49223
dead_host 192.168.56.101:49203
dead_host 192.168.56.101:49224
dead_host 192.168.56.101:49234
dead_host 192.168.56.101:49207
dead_host 192.168.56.101:49228
dead_host 192.168.56.101:49238
dead_host 192.168.56.101:49208
dead_host 192.168.56.101:49216
dead_host 45.14.13.58:3214
dead_host 192.168.56.101:49225
dead_host 192.168.56.101:49235
dead_host 192.168.56.101:49229
dead_host 192.168.56.101:49239
dead_host 192.168.56.101:49209
dead_host 192.168.56.101:49240
dead_host 192.168.56.101:49204
dead_host 192.168.56.101:49217
dead_host 192.168.56.101:49213
dead_host 192.168.56.101:49226
dead_host 192.168.56.101:49221
dead_host 192.168.56.101:49201
dead_host 192.168.56.101:49230
dead_host 192.168.56.101:49232
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49205
dead_host 192.168.56.101:49218
dead_host 192.168.56.101:49236
dead_host 192.168.56.101:49214
dead_host 192.168.56.101:49227