Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 17, 2021, 11:09 p.m.	March 17, 2021, 11:11 p.m.

Size	106.7KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`bb0c7c3de7df87cab6e7962ceab62b0f`
SHA256	`ef42ae97b53c0b06baab4e16b5348303ecf1d29db894bd857b63111e387235a5`
CRC32	`6EDDC01A`
ssdeep	`768:iXKvzRjJAbWIRXGmcyDTdxMmm8PMmAf6aHCzezcs2RG2AiIDaQzArh03/yMMU1KX:48zRWbWIRXGmRDTdx4ZUep2gMQzAyf`
Yara	PE_Header_Zero - PE File Signature Zero Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check

TeleKiller.exe "C:\Users\test22\AppData\Local\Temp\TeleKiller.exe"
2776
- cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 1
  2276
  - timeout.exe timeout 1
    2532
- TeleKiller.exe "C:\Users\test22\AppData\Local\Temp\TeleKiller.exe"
  2696

Name	Response	Post-Analysis Lookup
wu-tang.xyz
liverpooldabestteamoftheworld.com	A 172.67.197.219 A 104.21.52.98	104.21.52.98

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.197.219	Active	Moloch
216.239.34.21	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49199 -> 172.67.197.219:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49199 172.67.197.219:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	ab:17:eb:ee:6d:34:64:f6:f9:9e:e3:79:1d:99:79:ad:e1:e7:73:e7

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 17, 2021, 11:09 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 17, 2021, 11:09 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:09 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: Waiting for 1 console_handle: 0x00000007	1	1	0
WriteConsoleW March 17, 2021, 11:09 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d4838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d4938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d4938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00720ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00721078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00721078 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00721138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00721138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 17, 2021, 11:09 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007212f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2021, 11:09 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 17, 2021, 11:09 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1 mscorlib+0x2f45b0 @ 0x6ff345b0 mscorlib+0x30040a @ 0x6ff4040a system+0xff36c @ 0x6ec7f36c system+0xff2ef @ 0x6ec7f2ef system+0xff227 @ 0x6ec7f227 system+0xfef9d @ 0x6ec7ef9d system+0xea215 @ 0x6ec6a215 system+0x6f7878 @ 0x6f9b7878 system+0x6f6e71 @ 0x6f9b6e71 system+0x6f3892 @ 0x6f9b3892 system+0x6f3514 @ 0x6f9b3514 system+0x6f42ec @ 0x6f9b42ec 0xa106e4 0xa100c9 0xa10079 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3862216 registers.edi: 0 registers.eax: 3862216 registers.ebp: 3862296 registers.edx: 0 registers.ebx: 8601672 registers.esi: 7825432 registers.ecx: 1365506687	1	0	0
__exception__ March 17, 2021, 11:09 p.m.	stacktrace: 0xa15fc6 0xa1551f 0xa10b47 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x2cb060 @ 0x6ff0b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d36ad @ 0x6ff136ad mscorlib+0x308f2d @ 0x6ff48f2d microsoft+0x50c17 @ 0x6e340c17 microsoft+0x3f33f @ 0x6e32f33f microsoft+0x3edf8 @ 0x6e32edf8 microsoft+0x3e3b9 @ 0x6e32e3b9 microsoft+0x17e980 @ 0x6e46e980 0xa10960 0xa108e2 0xa100db 0xa10079 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: mscorlib+0x324f62 exception.address: 0x6ff64f62 registers.esp: 3860308 registers.edi: 3860332 registers.eax: 0 registers.ebp: 3860344 registers.edx: 0 registers.ebx: 41229448 registers.esi: 4194364 registers.ecx: 4194364	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 17, 2021, 11:09 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x728f1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x727c2ba1
mscorlib+0x2f45b0 @ 0x6ff345b0
mscorlib+0x30040a @ 0x6ff4040a
system+0xff36c @ 0x6ec7f36c
system+0xff2ef @ 0x6ec7f2ef
system+0xff227 @ 0x6ec7f227
system+0xfef9d @ 0x6ec7ef9d
system+0xea215 @ 0x6ec6a215
system+0x6f7878 @ 0x6f9b7878
system+0x6f6e71 @ 0x6f9b6e71
system+0x6f3892 @ 0x6f9b3892
system+0x6f3514 @ 0x6f9b3514
system+0x6f42ec @ 0x6f9b42ec
0xa106e4
0xa100c9
0xa10079
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3862216
registers.edi: 0
registers.eax: 3862216
registers.ebp: 3862296
registers.edx: 0
registers.ebx: 8601672
registers.esi: 7825432
registers.ecx: 1365506687

__exception__

March 17, 2021, 11:09 p.m.

stacktrace:

0xa15fc6
0xa1551f
0xa10b47
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d3711 @ 0x6ff13711
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x2cb060 @ 0x6ff0b060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
microsoft+0x50c17 @ 0x6e340c17
microsoft+0x3f33f @ 0x6e32f33f
microsoft+0x3edf8 @ 0x6e32edf8
microsoft+0x3e3b9 @ 0x6e32e3b9
microsoft+0x17e980 @ 0x6e46e980
0xa10960
0xa108e2
0xa100db
0xa10079
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol: mscorlib+0x324f62
exception.address: 0x6ff64f62
registers.esp: 3860308
registers.edi: 3860332
registers.eax: 0
registers.ebp: 3860344
registers.edx: 0
registers.ebx: 41229448
registers.esi: 4194364
registers.ecx: 4194364

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-896040F2AF009D79EEF149564853AB30.html
request	GET https://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-896040F2AF009D79EEF149564853AB30.html

Allocates read-write-execute memory (usually to unpack itself) (50 out of 65 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00852000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0086c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00885000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00887000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0085a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00877000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0086a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00876000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0085c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a suspicious process (2 events)

cmdline	cmd.exe /c timeout 1
cmdline	"C:\Windows\System32\cmd.exe" /c timeout 1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 17, 2021, 11:09 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c timeout 1 filepath: cmd.exe	1	1	0

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW March 17, 2021, 11:09 p.m.	newfilepath_r: C:\Users\test22\AppData\Local\叫吝吐吀可吀吉吟吙吔史叿吏吒向叼吓叼叭吝名叹叿_I\TeleKiller.exe_Url_v2yjhxzuroexka2b5zcwf3x5f5zhv2bn\1.193.173.485\user.config flags: 1 oldfilepath_r: C:\Users\test22\AppData\Local\叫吝吐吀可吀吉吟吙吔史叿吏吒向叼吓叼叭吝名叹叿_I\TeleKiller.exe_Url_v2yjhxzuroexka2b5zcwf3x5f5zhv2bn\1.193.173.485\j43hq1nb.newcfg newfilepath: C:\Users\test22\AppData\Local\叫吝吐吀可吀吉吟吙吔史叿吏吒向叼吓叼叭吝名叹叿_I\TeleKiller.exe_Url_v2yjhxzuroexka2b5zcwf3x5f5zhv2bn\1.193.173.485\user.config oldfilepath: C:\Users\test22\AppData\Local\叫吝吐吀可吀吉吟吙吔史叿吏吒向叼吓叼叭吝名叹叿_I\TeleKiller.exe_Url_v2yjhxzuroexka2b5zcwf3x5f5zhv2bn\1.193.173.485\j43hq1nb.newcfg	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 17, 2021, 11:09 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 17, 2021, 11:09 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (12 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Detection of Virtual Appliances through the use of WMI for use of evasion.	rule	WMI_VM_Detect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

216.239.34.21

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 180224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000694	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 17, 2021, 11:09 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELe»¦Òà0DîB @ À@BOÀ B H.text,C D `.rsrcÀH@@.reloc L@B base_address: 0x00400000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: 0 HXhäh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsDWEH WspT(CompanyNameKIf8FileDescriptionHKW GmO0FileVersion8.7.3.3: InternalNameNhNR HBq.exez+LegalCopyrightCopyright 2020 © Jgv. All rights reserved.2LegalTrademarksRtqRB OriginalFilenameNhNR HBq.exe2 ProductNameNhNR HBq4ProductVersion7.1.2.28Assembly Version7.1.2.2DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING base_address: 0x00428000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: @ð2 base_address: 0x0042a000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2696 process_handle: 0x00000694	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELe»¦Òà0DîB @ À@BOÀ B H.text,C D `.rsrcÀH@@.reloc L@B base_address: 0x00400000 process_identifier: 2696 process_handle: 0x00000694	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 called NtSetContextThread to modify thread in remote process 2696
NtSetContextThread March 17, 2021, 11:09 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4342510 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000698 process_identifier: 2696	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2776 resumed a thread in remote process 2696
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000698 suspend_count: 1 process_identifier: 2696	1	0	0

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Elastic	malicious (high confidence)
McAfee	RDN/Generic PWS.y
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005793451 )
Alibaba	TrojanDownloader:MSIL/Kryptik.da86faf4
K7GW	Trojan-Downloader ( 005793451 )
Cyren	W32/MSIL_Kryptik.DNK.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Sophos	Mal/Generic-S
DrWeb	Trojan.PWS.Siggen2.62925
McAfee-GW-Edition	RDN/Generic PWS.y
FireEye	Generic.mg.bb0c7c3de7df87ca
Ikarus	Trojan-Downloader.MSIL.Agent
GData	Win32.Trojan.Agent.NF37T3
Avira	TR/Dldr.Agent.tqrer
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	Trojan.Downloader.MSIL
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HOG
Rising	Downloader.Agent!8.B23 (CLOUD)
Fortinet	MSIL/Agent.HNY!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34628.gm1@auQOq!li
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (W)

Executed a process and injected code into it, probably while unpacking (43 events)

Time & API	Arguments	Status	Return
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x0000059c suspend_count: 1 process_identifier: 2776	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000438 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtSetContextThread March 17, 2021, 11:09 p.m.	registers.eip: 1920740228 registers.esp: 3862424 registers.edi: 61429528 registers.eax: 3211296 registers.ebp: 3862428 registers.edx: 58697400 registers.ebx: 0 registers.esi: 404200 registers.ecx: 62107640 thread_handle: 0x000000e4 process_identifier: 2776	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2776	1	0
CreateProcessInternalW March 17, 2021, 11:09 p.m.	thread_identifier: 2084 thread_handle: 0x000006a8 process_identifier: 2276 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c timeout 1 filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000006b0	1	1
CreateProcessInternalW March 17, 2021, 11:09 p.m.	thread_identifier: 2572 thread_handle: 0x00000698 process_identifier: 2696 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\TeleKiller.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\TeleKiller.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000694	1	1
NtGetContextThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000698	1	0
NtAllocateVirtualMemory March 17, 2021, 11:09 p.m.	process_identifier: 2696 region_size: 180224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000694	1	0
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELe»¦Òà0DîB @ À@BOÀ B H.text,C D `.rsrcÀH@@.reloc L@B base_address: 0x00400000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: base_address: 0x00402000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: 0 HXhäh4VS_VERSION_INFO½ïþ?ÈStringFileInfo¤040904b1, CommentsDWEH WspT(CompanyNameKIf8FileDescriptionHKW GmO0FileVersion8.7.3.3: InternalNameNhNR HBq.exez+LegalCopyrightCopyright 2020 © Jgv. All rights reserved.2LegalTrademarksRtqRB OriginalFilenameNhNR HBq.exe2 ProductNameNhNR HBq4ProductVersion7.1.2.28Assembly Version7.1.2.2DVarFileInfo$Translation PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING base_address: 0x00428000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: @ð2 base_address: 0x0042a000 process_identifier: 2696 process_handle: 0x00000694	1	1
WriteProcessMemory March 17, 2021, 11:09 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2696 process_handle: 0x00000694	1	1
NtSetContextThread March 17, 2021, 11:09 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4342510 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000698 process_identifier: 2696	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000698 suspend_count: 1 process_identifier: 2696	1	0
CreateProcessInternalW March 17, 2021, 11:09 p.m.	thread_identifier: 2324 thread_handle: 0x00000084 process_identifier: 2532 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\timeout.exe track: 1 command_line: timeout 1 filepath_r: C:\Windows\system32\timeout.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2696	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2696	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2696	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2696	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x00000228 suspend_count: 1 process_identifier: 2696	1	0
NtResumeThread March 17, 2021, 11:09 p.m.	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 2696	1	0

TeleKiller.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All